| 1 | # g1t plan |
| 2 | |
| 3 | g1t is where people and agents ship software together: a git platform built on Cloudflare Workers and Artifacts for |
| 4 | the "Build the Next-Gen Git Platform on Cloudflare" competition. |
| 5 | |
| 6 | - Submission closes **October 14, 2026, 11:59 PM PDT**: a 5–10 minute demo |
| 7 | video, this repository (MIT) and run instructions. |
| 8 | - Judging: 50% originality and quality of the prototype for agent-oriented |
| 9 | collaboration; 25% multi-agent concurrency, coordination, context |
| 10 | preservation, review and conflict handling; 25% ease of use. |
| 11 | |
| 12 | ## The point |
| 13 | |
| 14 | **g1t is where a team of agents ships code, with the people they work for.** |
| 15 | |
| 16 | Hosting git is table stakes, and g1t does it the familiar way: issues, |
| 17 | branches, pull requests, review, protected branches, people working by hand. |
| 18 | None of that is the selling point. The selling point is the layer above it, |
| 19 | which no forge has: **you hand g1t an outcome, and a fleet of agents converges |
| 20 | it onto `main`, coordinating with each other and with you, with every decision |
| 21 | on the record.** |
| 22 | |
| 23 | Three things only g1t does, and every feature should serve one of them: |
| 24 | |
| 25 | 1. **Outcomes, not pull requests.** The unit people work in is "make onboarding |
| 26 | work offline", not branch #4012. A brief becomes a plan of issues with |
| 27 | dependencies; agents take them as they unblock; people steer the outcome |
| 28 | and see it converge, rather than stopping at the pull request. |
| 29 | 2. **Agents that work as a team.** Agents know what the others are doing, file |
| 30 | what they find instead of widening their change, ask and answer each other |
| 31 | through the forge, and defer to people. Many agents on one codebase without |
| 32 | a human refereeing collisions. |
| 33 | 3. **`main` that only ever moves forward.** Every change lands through checks |
| 34 | in the combination it will live in (the merge queue), failures go back to the |
| 35 | agent that wrote them, and any line can answer "why is this here?" |
| 36 | |
| 37 | ## Product model |
| 38 | |
| 39 | g1t keeps the two things every engineer already knows, issues and pull |
| 40 | requests, and changes the assumption underneath them. A forge built for |
| 41 | people expects a few changes in flight, each watched by its author. g1t |
| 42 | expects dozens of agents working at once across a project, each on its own |
| 43 | issue, all of which have to land on `main`. A person assigns an issue to |
| 44 | g1t and chooses nothing else: not how many agents, and not which |
| 45 | model. An issue can still collect more than one pull request (a second |
| 46 | attempt, or someone's own agent alongside g1t's), and when it does the |
| 47 | issue records which one was taken. |
| 48 | |
| 49 | | Concept | What it is | |
| 50 | | --- | --- | |
| 51 | | **Issue** | What should change in a repo: a bug, a feature, a question. Opened by a person, an agent or an integration such as an error tracker. Carries labels, a description that may say what done means (a Definition of done: context, never a gate), comments, and every pull request made for it. What a merge needs is the default branch's required checks: workflow statuses, the same for people and agents. | |
| 52 | | **Pull request** | A proposed change in its own Artifacts fork, made by an agent or a person, usually for an issue. Any number can be open for one issue. Starts as a draft; marked ready; merged or closed. | |
| 53 | | **Session** | The agent's full context for a pull request: prompt, messages, tool calls, cost. Stored with the pull request and linked from every commit it produced. | |
| 54 | | **Compare view** | Every pull request for an issue side by side with diff, check results, conflicts against main and against each other, and a reviewer agent's summary. | |
| 55 | | **Merge** | A person or a policy picks a pull request. A per-repo merge queue lands it. The issue closes, recording which pull request resolved it; the others for that issue close as superseded, or are rebased by their agents when the issue is kept open. | |
| 56 | |
| 57 | Issues and pull requests share one sequence of numbers per repository, so |
| 58 | `#12` names exactly one of them. |
| 59 | |
| 60 | Features that fall out of the model: |
| 61 | |
| 62 | - **Why-blame.** Click a line and see the prompt and reasoning that produced |
| 63 | it, not only the commit. |
| 64 | - **Overlap radar.** Pull requests that touch the same files are flagged |
| 65 | while the agents are still working, and the agents are told. |
| 66 | - **Live lanes.** Watch every pull request progress in real time. |
| 67 | |
| 68 | ## Why issues and pull requests, not something new |
| 69 | |
| 70 | An earlier version of this plan merged the two into one new object, an |
| 71 | "issue" holding "pull requests". That was wrong, for three reasons. |
| 72 | |
| 73 | - **Issues come from everywhere.** People file them, agents file them, and |
| 74 | Sentry files them. Most are never worked on by whoever opened them. They |
| 75 | need their own life: labels, triage, discussion, closing as not planned. |
| 76 | - **"Which change did we take?" needs two objects.** When five agents each |
| 77 | propose a change, the answer has to be recorded somewhere other than the |
| 78 | five proposals. On g1t it is on the issue: `resolved by #14`. |
| 79 | - **Nobody should have to learn a word to use the product.** An engineer who |
| 80 | has used any forge can use g1t on the first day, and finds the agent |
| 81 | features where they would look for them. |
| 82 | |
| 83 | What g1t adds to the familiar pair: |
| 84 | |
| 85 | - **Several pull requests per issue is supported**, not an accident. It |
| 86 | is the exception, for a second attempt or a competing one, but when it |
| 87 | happens the issue's page lists them with their state, and merging one |
| 88 | closes the issue with that pull request recorded and the others marked |
| 89 | superseded. |
| 90 | - **A pull request can be part of the work.** Merging with "keep the issue |
| 91 | open" leaves the issue and its other pull requests alone. |
| 92 | - **Every pull request has a fork and a session.** See |
| 93 | [forks and branches](https://docs.g1t.sh/concepts/forks/). |
| 94 | - **Labels need no setup.** A repository starts with the default labels |
| 95 | (`bug`, `documentation`, `enhancement`, `question`, `dependencies`, |
| 96 | `security` and the rest), each with a color and a description, on issues |
| 97 | and pull requests alike; someone with Triage makes a new one as they use |
| 98 | it. **Milestones** gather issues and pull requests under a goal and a |
| 99 | due date. Pull requests can merge into any branch; the default branch's |
| 100 | protection holds only for those into it. |
| 101 | - **The developer path is unchanged.** Push a branch, open a pull request |
| 102 | from it, get review, merge. Agents get a fork per pull request instead. |
| 103 | - **Both paths meet at `main`.** The same landing rules apply to a person's |
| 104 | pull request and an agent's. |
| 105 | |
| 106 | ## Converging on main |
| 107 | |
| 108 | Twelve issues started together will finish at different times and touch |
| 109 | overlapping code. Getting them all into `main` without a person refereeing |
| 110 | is the hard part, and it is handled in four places. |
| 111 | |
| 112 | 1. **Before work starts: plan the overlap away.** A project is a graph of |
| 113 | issues. A planner agent can split a large goal into issues, predict |
| 114 | which files each will touch, and add a dependency where two would collide, |
| 115 | so one starts from the other's result instead of from `main`. |
| 116 | 2. **While agents work: overlap radar.** Each pull request's changed files and |
| 117 | symbols are tracked as it pushes. When two pull requests from different issues |
| 118 | enter the same area, both agents are told what the other is doing there. |
| 119 | 3. **When `main` moves: the author resolves.** Every open pull request is |
| 120 | trial-merged against the new `main`. A clean merge updates the pull request |
| 121 | silently. A conflict resumes that pull request's agent with its original |
| 122 | session and the incoming change, so the conflict is resolved by the agent |
| 123 | that wrote the code and still knows why. |
| 124 | 4. **At landing: a speculative queue.** Approved pull requests enter the |
| 125 | repo's queue. g1t builds the combined states (`main`+A, `main`+A+B, …) and runs |
| 126 | their checks in parallel. Pull requests land in order as their combined state |
| 127 | passes; one that fails is ejected back to its agent and the states behind |
| 128 | it are rebuilt. `main` only ever receives a state that passed. |
| 129 | |
| 130 | Landing can be fully automatic: a repo policy such as "checks pass and the |
| 131 | reviewer agent approves" merges without a person. |
| 132 | |
| 133 | ## Agents aware of each other |
| 134 | |
| 135 | Each repo keeps a live **work registry**: for every running pull request, its |
| 136 | issue, a running summary of what it has done, and the files and symbols it |
| 137 | has touched or plans to touch. Agents use it through MCP tools; g1t also |
| 138 | acts on it without being asked. |
| 139 | |
| 140 | - **Before starting.** When an issue is opened, or an agent is about to |
| 141 | begin a task, g1t searches open issues and running pull requests for the same |
| 142 | goal (by meaning, not wording) and for the same area of code. If a match |
| 143 | exists the agent is told who is on it and how far along, and chooses: join |
| 144 | as a deliberate racer, wait for the result, or drop the task. Duplicate |
| 145 | issues are offered for merging. |
| 146 | - **Finding out-of-scope work.** An agent that discovers something outside |
| 147 | its issue asks the registry who works there. If another pull request owns that |
| 148 | area, it **hands off**: a note, the relevant excerpt of its session, and |
| 149 | optionally commits the receiver can take. If nobody does, it opens a child |
| 150 | issue instead of widening its own change. |
| 151 | - **Asking.** An agent can put a question or a request to another pull request. |
| 152 | The receiver gets it at its next turn. |
| 153 | - **Waiting.** An agent that needs another pull request's result parks itself. |
| 154 | Its sandbox sleeps, spend stops, and it resumes from the new state when |
| 155 | that pull request merges. |
| 156 | - **Agents that do not cooperate.** For pushes from tools that never call |
| 157 | these tools, g1t compares the pushed change against running pull requests and |
| 158 | flags near-duplicates itself. |
| 159 | |
| 160 | Every handoff, question and wait has a state (offered, accepted, declined, |
| 161 | done), appears in the timeline, and is visible to people. A handoff declined |
| 162 | twice, or two agents passing work back and forth, goes to the "needs you" |
| 163 | inbox. |
| 164 | |
| 165 | ## Review at scale |
| 166 | |
| 167 | Cloudflare's brief asks "how do you review everything they produce?". With |
| 168 | hundreds of agents, a person cannot read every diff, so review is by |
| 169 | exception. |
| 170 | |
| 171 | - **Evidence, not diffs.** Every pull request carries a proof bundle: checks run |
| 172 | and their output, a preview URL, a plain-language summary, and the |
| 173 | behaviour that changed. |
| 174 | - **Two agent reviewers.** One reviews the change against the issue. A |
| 175 | second is adversarial: it tries to break the change and reports what it |
| 176 | found. |
| 177 | - **Risk tiers.** Each change is scored from what it touches, how large it |
| 178 | is, and how the reviewers ruled. Low risk merges on policy; high risk goes |
| 179 | to a person with the evidence already assembled. |
| 180 | - **Trust is earned.** An agent's record on a path (merged, reverted, caught |
| 181 | by review) raises or lowers the tier its changes land in. |
| 182 | - **Sampling.** A share of auto-merged changes is sent to a person anyway, |
| 183 | to keep the policy honest. |
| 184 | |
| 185 | ## Rethinking the git primitives |
| 186 | |
| 187 | - **No branches for agents.** A pull request is a fork; `main` is the only |
| 188 | long-lived line. There is nothing to name, clean up or go stale. |
| 189 | - **Projected main.** New pull requests start from `main` plus everything already |
| 190 | in the landing queue, so they are built on the state they will land on. |
| 191 | - **Structural merge.** The merge engine merges by syntax tree, not by line, |
| 192 | for supported languages. Two agents adding different functions to the same |
| 193 | file do not conflict. |
| 194 | - **Forkable sessions.** A session can be forked at any turn: the code as it |
| 195 | was at that moment plus the conversation up to it, continued with a |
| 196 | different instruction. Branching applies to the reasoning as well as the |
| 197 | code. |
| 198 | - **Provenance in history.** Every commit records its issue, session, |
| 199 | agent, model and cost, and is signed with a key issued to that pull request. The |
| 200 | history can be audited by machine. |
| 201 | |
| 202 | ## People in the loop |
| 203 | |
| 204 | ### Code that arrives from outside |
| 205 | |
| 206 | People will keep pushing with plain git, their editor, or another tool. Every |
| 207 | push goes through g1t's git front end, so none of it bypasses the model. |
| 208 | |
| 209 | - **A push to a branch becomes a pull request.** g1t adopts it with the pusher as |
| 210 | author. A reviewer agent writes the issue it appears to serve and offers |
| 211 | to attach it to an open issue it matches. From there it gets the same |
| 212 | checks, compare view and queue as agent work. |
| 213 | - **A push to `main` follows repo policy.** Protected: refused with a message |
| 214 | saying which ref to push to instead, so it enters the queue. Open: accepted |
| 215 | and treated as "`main` moved", which re-verifies the queue and triggers |
| 216 | resolve-on-move for every open pull request. |
| 217 | - **Context is an open format.** A commit trailer names the session that |
| 218 | produced it, so any tool can attach its transcript. Commits without one are |
| 219 | shown in why-blame as "pushed by a person, no session". |
| 220 | - **Approval rules.** Per repo and per path: merge automatically, require a |
| 221 | named person, or require a person when the change is large or the reviewer |
| 222 | agent is unsure. |
| 223 | |
| 224 | ### Joining work that is already running |
| 225 | |
| 226 | - **Every session has a live page** that works on a phone: the transcript as |
| 227 | it streams, the current diff, check results. |
| 228 | - **Steer.** Send a message, pause, or redirect. Hosted agents receive it |
| 229 | immediately; a person's own Claude Code receives it at its next turn |
| 230 | through the CLI hooks. |
| 231 | - **Answer.** When an agent is blocked on a question, it appears in a "needs |
| 232 | you" inbox and as a notification. The answer resumes the agent. |
| 233 | - **Take over and hand back.** Check out the pull request's fork, commit by hand, |
| 234 | push, and let the agent continue from there. |
| 235 | |
| 236 | ### Planning by writing |
| 237 | |
| 238 | - **Brief.** Write the outcome in prose on the site, or commit it as a |
| 239 | markdown file. A planner agent turns it into a project: issues, each with |
| 240 | what done means, and dependencies. The person edits the graph before anything starts. |
| 241 | - **Plan from their own agent.** The same operations are MCP tools, so a |
| 242 | person can plan in their own Claude Code session and create the project |
| 243 | from there. |
| 244 | - **The brief stays the source of truth.** Editing it later re-plans: new |
| 245 | issues are added, obsolete ones are closed. |
| 246 | |
| 247 | ### Seeing what moved |
| 248 | |
| 249 | - **Project page.** The outcome, the issue graph coloured by state, and how |
| 250 | many of its issues have landed with their required checks passing, |
| 251 | compared with when the project started. |
| 252 | - **Digest.** An agent-written summary per project and per person: what |
| 253 | merged, what is blocked on whom, which conflicts were resolved, what it |
| 254 | cost. |
| 255 | - **Timeline.** Every event (push, steer, check, conflict, merge) in order, |
| 256 | each linked to the session and the person or agent behind it. |
| 257 | |
| 258 | ## One session, any surface |
| 259 | |
| 260 | A session belongs to g1t, not to the device it started on. The browser, a |
| 261 | phone and Claude Code are views of the same session. |
| 262 | |
| 263 | - **Browser and phone.** The site is a responsive, installable web app with |
| 264 | push notifications. Everything a person does (brief, steer, answer, |
| 265 | approve, merge) works there. |
| 266 | - **Claude Code.** Through `mcp.g1t.sh` and the CLI hooks, a local session is |
| 267 | a g1t session: its transcript syncs as it runs and it appears in mission |
| 268 | control like any other. |
| 269 | - **Moving a session.** A local session can be sent to the cloud: a hosted |
| 270 | agent takes over the fork and the transcript and continues, so the laptop |
| 271 | can close. A hosted session can be pulled down: the CLI checks out the fork |
| 272 | and resumes it in local Claude Code with its history. |
| 273 | - **Limit.** A session running only on a laptop stops when the laptop does. |
| 274 | It can be steered between turns but not continued until it is moved or the |
| 275 | laptop is back. |
| 276 | |
| 277 | ## For people who do not write code |
| 278 | |
| 279 | - **Documents are first-class.** Specs, guides, policies and decisions live |
| 280 | in repos as markdown, shown in a Docs view: rendered pages, edited in the |
| 281 | browser like a document, with inline comments. "Suggest a change" is an |
| 282 | pull request and "publish" is merge, without git vocabulary. |
| 283 | - **Document issues.** "Write the onboarding guide for the billing API" is |
| 284 | an issue. Its Definition of done is a checklist judged by a reviewer agent |
| 285 | instead of a workflow. Agents draft and revise; people comment and approve. |
| 286 | - **Templates.** Product brief, RFC, decision record. A filled-in template is |
| 287 | a brief the planner can turn into a project. |
| 288 | - **Explain.** Ask about any repo, project or change in plain language and |
| 289 | get an answer with links to the code and sessions behind it. |
| 290 | - **Living documentation.** g1t generates "how this works" pages from the |
| 291 | code and keeps them current. When a merged change contradicts a document, |
| 292 | an issue opens to update it. |
| 293 | - **See it, don't read it.** Every pull request on a deployable repo gets a |
| 294 | preview URL (Workers Builds from the pull request's fork), so an approver clicks |
| 295 | through the result instead of reading a diff. Changes are also summarised |
| 296 | in plain language. |
| 297 | - **Roles.** Viewer, commenter, planner, approver: a person can plan and |
| 298 | approve work without ever cloning a repo. |
| 299 | |
| 300 | ## The macro view |
| 301 | |
| 302 | The hierarchy above a single repo: |
| 303 | |
| 304 | | Level | What it is | |
| 305 | | --- | --- | |
| 306 | | **Workspace** | A company or team: its people, repos, agents, budget and policies. | |
| 307 | | **Initiative** | A business outcome with an owner and measurable results, e.g. "move billing to usage-based pricing". Spans any number of repos. | |
| 308 | | **Outcome** | One deliverable inside an initiative: a brief and its graph of issues (shown as **Plan**). Called "project" before 2026-10-04; that name now means what [Projects](#projects) describes. | |
| 309 | | **Issue / Pull request** | As above. An issue may touch several repos; a pull request for it then holds one fork per repo and they land together. | |
| 310 | |
| 311 | How it feeds up, and what is built: |
| 312 | |
| 313 | - **A workspace is the unit everything belongs to.** Repositories, people, |
| 314 | access tokens, and later projects, budgets and policies are the |
| 315 | workspace's, never a person's. An account owns nothing; its first step |
| 316 | after confirming its email is creating a workspace, and the site sends it |
| 317 | there from wherever it was going. |
| 318 | - **One namespace.** Usernames and workspaces share one set of names, as on |
| 319 | Docker Hub and npm. A username is reserved for its owner's workspace, so |
| 320 | `g1t.sh/<name>` never means two things. |
| 321 | - **The workspace page is the roll-up.** `g1t.sh/<workspace>` shows its |
| 322 | repositories with their open issues and pull requests, and the pull |
| 323 | requests in progress across all of them. Projects and initiatives will |
| 324 | roll up to the same page. Its own pages live under `/<workspace>/-/` |
| 325 | (people, access tokens, settings), which no repository can be named. |
| 326 | - **Workspace access tokens instead of service accounts.** A workspace has |
| 327 | tokens of its own, in the same table and code path as personal ones. One |
| 328 | acts as the workspace, with a member's rights in that workspace only (the |
| 329 | Write role on its repositories; Admin only when an owner ticks it at |
| 330 | creation, `access_tokens.admin`, identity/0034), records who made it and |
| 331 | when it was last used, and keeps working when that person leaves. CI, |
| 332 | integrations and automations use these. Until 2026-10-08 the code gave |
| 333 | them Admin on every repository, which the security audit found let any |
| 334 | workspace token manage webhooks; code, this plan and the docs now agree. |
| 335 | |
| 336 | ### Portfolio |
| 337 | |
| 338 | One page answers "where is the business" across every initiative: |
| 339 | |
| 340 | - **Health** per initiative: on track, at risk, or blocked, derived from |
| 341 | facts (checks passing, issues stalled, questions waiting on a person), |
| 342 | not self-reported. |
| 343 | - **Progress** as measurable results: required checks passing, issues |
| 344 | merged out of planned, and the trend since the start. |
| 345 | - **Forecast** from actual throughput: at the current rate, when the |
| 346 | remaining issues land. |
| 347 | - **Spend** in tokens and dollars against a budget, per initiative. |
| 348 | - **Waiting on people**: every decision or approval a person owes, by name. |
| 349 | - **Roadmap**: initiatives laid out as now, next, later, with optional |
| 350 | time-boxed cycles for teams that work in sprints. |
| 351 | |
| 352 | ### Status without asking |
| 353 | |
| 354 | - **Standup.** An agent writes a daily report per initiative and one for the |
| 355 | whole workspace: what merged, what changed direction, what is at risk and |
| 356 | why, what needs a person. Delivered by email or webhook. |
| 357 | - **Ask.** A question box over the full event log and all sessions: "what |
| 358 | happened on the billing migration since Monday?" answers with links to the |
| 359 | sessions and commits behind each claim. |
| 360 | |
| 361 | ### Long-running agents |
| 362 | |
| 363 | Work that runs for days needs supervision that does not depend on someone |
| 364 | watching. |
| 365 | |
| 366 | - **Checkpoints.** A long pull request reports milestones against its issue, so |
| 367 | progress is visible before anything merges. |
| 368 | - **Stall and drift detection.** A pull request with no meaningful progress, or |
| 369 | whose changes have wandered away from its issue, is flagged and can be |
| 370 | stopped or re-briefed automatically. |
| 371 | - **Budgets.** Hard limits on spend and time per pull request, project and |
| 372 | initiative. |
| 373 | |
| 374 | ### Context hub |
| 375 | |
| 376 | Agents working across repos and days need context that outlives any one |
| 377 | session and reaches beyond the code. The context hub is one place an agent |
| 378 | asks, whatever the source. |
| 379 | |
| 380 | | Source | What it holds | How it gets there | |
| 381 | | --- | --- | --- | |
| 382 | | **Memory** | Decisions, conventions, gotchas, facts about systems | Written by agents and people in g1t | |
| 383 | | **Code and sessions** | The repos, and the reasoning behind every change | Already in g1t | |
| 384 | | **Connected sources** | Jira and Linear tickets, Notion and Confluence pages, Google Drive documents, Slack threads, Sentry issues | Connectors, authorised per workspace | |
| 385 | |
| 386 | How it behaves: |
| 387 | |
| 388 | - **One search.** An agent asks a question and gets ranked results across |
| 389 | all sources, each labelled with where it came from, who wrote it, and how |
| 390 | fresh it is. |
| 391 | - **Connected sources stay where they are.** g1t indexes them for search and |
| 392 | fetches the current version when an agent opens one. The external system |
| 393 | remains the source of truth, and a link placed on an issue ("see |
| 394 | JIRA-482", a Notion URL) is pulled into the agent's starting context. |
| 395 | - **Permissions carry over.** A connector only exposes what the connecting |
| 396 | account can see, and a workspace admin chooses which spaces, projects or |
| 397 | channels are included. |
| 398 | - **External content is untrusted.** A ticket or page can contain text meant |
| 399 | to manipulate an agent. It is marked as reference material, never treated |
| 400 | as instructions. |
| 401 | - **Documentation is separate.** Context is what agents know; documentation |
| 402 | is what people read, and it is generated from context and code. |
| 403 | |
| 404 | Memory is the part of the hub that g1t owns and agents write to: |
| 405 | |
| 406 | - **Memory is written freely.** Any agent or person adds an entry with one |
| 407 | call: a decision, a convention, a gotcha, a fact about a system. No review |
| 408 | gate. Each entry records who wrote it, from which session, and when. |
| 409 | - **It is still a repository.** Each workspace has a memory repo in |
| 410 | Artifacts, so every write is a commit: versioned, attributable, and |
| 411 | revertible. |
| 412 | - **It is kept healthy by an agent.** A consolidation agent merges |
| 413 | duplicates, retires entries that newer ones contradict, and flags |
| 414 | conflicts it cannot settle. People can pin an entry (agents may not change |
| 415 | it), correct it, or retract it. |
| 416 | - **Agents read it.** Every session starts with the context relevant to its |
| 417 | issue, found by search, and can query more through MCP. |
| 418 | - **Updates are events.** A memory write or a change in a connected source |
| 419 | is an event, so "when context changes, update the affected docs" is an |
| 420 | automation, on by default. |
| 421 | - **It is scoped inside the workspace.** Some context applies to the whole |
| 422 | workspace, some to one initiative, project or repo, so an agent gets what |
| 423 | applies to its work. |
| 424 | - **It never crosses workspaces.** A workspace is the isolation boundary: its |
| 425 | context, sessions and private repos are invisible to every other |
| 426 | workspace, and an agent's token is bound to one workspace. |
| 427 | |
| 428 | ## Working in g1t |
| 429 | |
| 430 | - **Mission control.** The signed-in home page: every running session, every |
| 431 | issue waiting on a decision, and what merged, across all repos. |
| 432 | - **Outcomes.** Group issues across repos toward one result and track how |
| 433 | many are open, racing, or merged. (What [Projects](#projects) means is |
| 434 | below.) |
| 435 | - **Steering.** Send a message to a running pull request, or to all pull requests on an |
| 436 | issue at once, without stopping them. |
| 437 | - **Automations.** Rules that start work without a person (next section). |
| 438 | |
| 439 | ## Automations and integrations |
| 440 | |
| 441 | > **2026-10-03:** g1t's own `.g1t/automations` format was built and then set |
| 442 | > aside at the user's request ("let's just copy GitHub Actions on that for the |
| 443 | > time being"). Automation on g1t is GitHub Actions workflows in |
| 444 | > `.g1t/workflows/`; the format below is kept for later. |
| 445 | |
| 446 | An automation is **when** an event happens, **if** conditions hold, **do** |
| 447 | something. They are defined as files in the repo (`.g1t/automations/`), the |
| 448 | way GitHub Actions workflows are, and can also be built in the UI. |
| 449 | |
| 450 | ### Events that can trigger one |
| 451 | |
| 452 | | Source | Examples | |
| 453 | | --- | --- | |
| 454 | | Git | push, merge, check failed, `main` moved | |
| 455 | | g1t | issue opened, pull request stalled, context updated, handoff declined, budget reached | |
| 456 | | Time | cron schedule | |
| 457 | | Integrations | Sentry issue, PagerDuty incident, Linear or Jira ticket, Slack message or mention, GitHub issue, Stripe event | |
| 458 | | Anything else | a signed generic webhook, or an email to a per-repo address | |
| 459 | |
| 460 | **Actions**: open an issue (optionally assigning N agents to it), message |
| 461 | a running pull request, update documentation, notify, call a |
| 462 | webhook, write back to the source system. |
| 463 | |
| 464 | **Example: Sentry.** A new production error arrives. The automation opens an |
| 465 | issue labelled `bug`, with the stack trace, release and frequency in its |
| 466 | description. Why-blame |
| 467 | finds the session that wrote the failing line, so the fixing agent starts |
| 468 | with the original reasoning. When the fix merges, g1t comments on the Sentry |
| 469 | issue and resolves it. |
| 470 | |
| 471 | ### Rules every automation obeys |
| 472 | |
| 473 | - **Deduplication.** The same Sentry issue firing 500 times maps to one |
| 474 | issue. |
| 475 | - **Limits.** Concurrency and budget caps per automation. |
| 476 | - **Loop protection.** Work started by an automation cannot retrigger the |
| 477 | same automation without a person in between. |
| 478 | - **External input is untrusted.** A webhook payload can contain text written |
| 479 | by an attacker. Agents started by external events run with reduced |
| 480 | permissions and cannot merge without the repo's approval rule passing. |
| 481 | |
| 482 | **Checks** are the other half of what GitHub Actions does: build and test |
| 483 | commands declared in `.g1t/checks.yaml`, run in sandboxes on every pull request |
| 484 | and on every combined state in the landing queue. |
| 485 | |
| 486 | ### Tokens, scopes and packages the GitHub way (built 2026-10-08) |
| 487 | |
| 488 | > **2026-10-08 (owner):** "emulate all of what GitHub does for scope |
| 489 | > mapping and packages." GitHub's current behaviour is the spec. |
| 490 | |
| 491 | This **reverses identity/0023**, which retired a token's reach to some |
| 492 | workspaces or repositories and left classic tokens only. The reason it is |
| 493 | reversed: the owner chose GitHub parity, and GitHub has fine-grained tokens |
| 494 | beside classic ones, with workspaces (organizations) governing both. |
| 495 | |
| 496 | - **Fine-grained personal access tokens** (identity/0034, |
| 497 | `services/identity/src/token_reach.rs`, `g1t_contracts::fine_grained`): |
| 498 | one resource owner (a workspace the person belongs to, or their own |
| 499 | account), all, selected (up to 50, by repository id) or only public |
| 500 | repositories, and a level per permission under GitHub's names (contents, |
| 501 | metadata, issues, pull_requests, actions, workflows, checks, statuses, |
| 502 | deployments, pages, environments, secrets, variables, webhooks, |
| 503 | administration, packages, security_events; members, |
| 504 | workspace_administration, self_hosted_runners, workspace_secrets, |
| 505 | workspace_webhooks, workspace_billing, models; email_addresses, starring, |
| 506 | notifications; g1t's agents and memory). Each level maps onto g1t's |
| 507 | scopes, which the token stores, so every check that reads scopes |
| 508 | (`scopes::decide` for the API and MCP, `decide_git`, `decide_packages`) |
| 509 | reads them unchanged. They must expire, within 366 days. On each use, |
| 510 | identity cuts the resolved person down to the token's reach |
| 511 | (`apply_reach`); `access::granted` gives no role outside it, so a public |
| 512 | repository elsewhere still reads and nothing more. |
| 513 | - **Governance** (`token_policies`, `token_workspace_revocations`): per |
| 514 | workspace, allow classic, allow fine-grained, require approval (on by |
| 515 | default, as GitHub's; owners' own tokens never wait), the longest |
| 516 | lifetime, and forbidding tokens that never expire. Owners see every |
| 517 | member's token that can reach the workspace, approve or deny pending |
| 518 | fine-grained ones (inbox: `token.approval_requested` and |
| 519 | `token.approval_reviewed`, the inbox's first notices about no |
| 520 | repository), and revoke one there. REST and MCP for owners; audited as |
| 521 | `token.*`. |
| 522 | - **Workflow files** need `workflow_files:write` (GitHub's `workflow` |
| 523 | scope; the `workflows` permission) from any token, checked commit by |
| 524 | commit on push (`services/repos/src/workflow_gate.rs`) and on files g1t |
| 525 | writes for a token. A job's token never has it. g1t's agents push with |
| 526 | run credentials, not tokens, and are not gated by it; their work arrives |
| 527 | as pull requests people review. |
| 528 | - **Workspace tokens** have Write unless an owner gives Admin at creation. |
| 529 | - **Deploy keys** (identity/0035): per repository, read-only unless write |
| 530 | is ticked; resolved to a principal bound to the one repository. |
| 531 | Serving git over SSH is still to come, so nothing uses them yet. |
| 532 | - **Packages**: per-package roles with "inherit access from the linked |
| 533 | repository", "Manage Actions access" enforced against job tokens, linking |
| 534 | by `org.opencontainers.image.source`, 30-day soft delete with restore and |
| 535 | a purge, a settings tab, public REST and MCP, and download counts per |
| 536 | version in every registry. |
| 537 | |
| 538 | ### Keeping workflow runs safe (built 2026-10-08) |
| 539 | |
| 540 | An audit of g1t Actions found a job's token was a full-access workspace |
| 541 | token, environments had no protection, outside pull requests ran at once, |
| 542 | the cache could be poisoned across branches, a job's token could set off |
| 543 | more runs, and masking missed multi-line and encoded secrets. Now: |
| 544 | |
| 545 | - **The job's token** (`G1T_TOKEN`, `GITHUB_TOKEN`) is minted per job by |
| 546 | identity (`create_job_token`, migration identity/0030): it reaches its |
| 547 | repository only (`TokenAccess.repo`, enforced by the API, git and the |
| 548 | registries), carries the scopes its `permissions:` map to |
| 549 | (`g1t_actions::permissions`), is revoked when the job ends, and its |
| 550 | writes are audited with the run as `run_kind: workflow_job`. Without |
| 551 | `permissions:` it gets the repository's default, the GitHub way: |
| 552 | repositories that existed when actions/0007 ran keep read and write, |
| 553 | newer ones take their workspace's default (read-only unless an owner |
| 554 | says), and a workspace can cap every repository at read-only. An outside |
| 555 | pull request's is read-only. "Allow g1t Actions to create and approve |
| 556 | pull requests" (repository and workspace, off by default) decides whether |
| 557 | the token may open or approve pull requests. OIDC (`id-token: write`) |
| 558 | reads the same permissions model. |
| 559 | - **No loops.** Work and repos mark the events a job's token causes |
| 560 | (`causedByJob`), carried on to a pull request it moves; the actions |
| 561 | service starts nothing for them. `workflow_dispatch` and |
| 562 | `repository_dispatch` (now sent by `POST {repo}/dispatches`) still start |
| 563 | runs. |
| 564 | - **Environments' protection rules** (actions/0007): required reviewers |
| 565 | (people or teams, up to six, optionally not whoever started the run), a |
| 566 | wait timer, which branches and tags may deploy, and admin bypass. A job |
| 567 | naming one is `pending` once its needs are done, its environment read |
| 568 | then (an expression included); reviewers hear in the inbox |
| 569 | (`deployment.review_requested`) and approve on the run's page or through |
| 570 | `pending_deployments`; secrets are read only when the job starts. |
| 571 | - **Approval for outside pull requests**, by a repository policy |
| 572 | (first-time contributors, outside contributors (the default), or every |
| 573 | external contributor): such runs are `action_required` until someone with |
| 574 | Write approves them. |
| 575 | - **The cache is scoped by ref** (own, then the pull request's base, then |
| 576 | the default branch; outside pull requests save where nothing else reads) |
| 577 | and versioned by its paths and compression (0006's toolkit `version`, |
| 578 | which g1t's runner now sends too); g1t's `actions/cache` and the |
| 579 | toolkit's protocols share one scope rule. Entries from before were |
| 580 | expired. |
| 581 | - **Masking** covers each line of a multi-line secret, base64 at every |
| 582 | offset and JSON-escaped forms; outputs holding a secret are withheld and |
| 583 | annotations masked. |
| 584 | - A job's own `concurrency:` is honoured, `create` runs on new branches and |
| 585 | tags, and `on: delete` says plainly that it never runs yet. |
| 586 | ### Docker in workflow jobs (built 2026-10-08) |
| 587 | |
| 588 | > **2026-10-08:** "Why didn't we give CI docker then? We need GitHub |
| 589 | > Actions functionality maxxed baby but with all the good good security |
| 590 | > etc." The trigger: `deploy.yml`'s runner-image job needs `docker build` |
| 591 | > and `docker push`, and failed on hosted runners. |
| 592 | |
| 593 | **What Cloudflare Containers allow** (their FAQ, updated 2026-10-05, and |
| 594 | the Docker-in-Docker guide and example it links): |
| 595 | |
| 596 | - Docker runs inside a container: `docker:dind`, with `dockerd` as |
| 597 | **root**. A rootless Engine does not start there. |
| 598 | - **No iptables**: `--iptables=false --ip6tables=false`, or the Engine |
| 599 | fails setting up its rules. Containers with the `durable_object` |
| 600 | scheduling policy (ours: each sandbox is a Durable Object's) cannot turn |
| 601 | IP forwarding on either: `--ip-forward=false`, or the Engine exits. |
| 602 | - So **a bridge network has no way out**: the guide's answer is |
| 603 | `--network=host` for `docker run` and `docker build`, which gives |
| 604 | containers the outer container's network. |
| 605 | - Built images and containers are lost when the sandbox stops. |
| 606 | |
| 607 | **What was found by trying** (Docker Engine 29.8.2 in a privileged |
| 608 | container standing in for a sandbox, with the same flags): |
| 609 | |
| 610 | - `--bridge=none` makes BuildKit's `RUN` steps fail outright ("network |
| 611 | bridge not found"); with the default bridge they run with no route out. |
| 612 | Containers default to the bridge too. The default bridge is created |
| 613 | fine without iptables, as the FAQ's own example relies on. |
| 614 | - The overlay snapshotter does not work on an overlay root filesystem, and |
| 615 | the containerd image store does not fall back by itself: the Engine |
| 616 | starts, then every container fails to mount. Whether a sandbox's disk |
| 617 | takes overlays is not documented, so the runner tries a mount first and |
| 618 | uses `native` (plain copies) when it fails. `vfs` is not a name the |
| 619 | containerd store accepts. |
| 620 | - `--cpus` and `--memory` need cgroup v2 controllers handed down from a |
| 621 | cgroup with no processes, which `docker:dind`'s entrypoint does and a |
| 622 | plain `dockerd` does not. |
| 623 | - A `runc` earlier on the Engine's `PATH` is used both for containers (via |
| 624 | containerd's shim) and by BuildKit's executor, with the bundle's |
| 625 | `config.json` written before it runs. BuildKit's bridged steps carry |
| 626 | libnetwork's `libnetwork-setkey` prestart hook; `RUN --network=none` |
| 627 | does not. |
| 628 | - Buildx skips `type=gha` caches when the job has no GitHub cache service, |
| 629 | and the build succeeds without one. |
| 630 | - Registries' layer hosts: Docker Hub sends layers from |
| 631 | `production.cloudfront.docker.com` (and `production.cloudflare.docker.com`), |
| 632 | Quay from `cdn0N.quay.io`, Microsoft's from regional |
| 633 | `*.data.mcr.microsoft.com`, public ECR from a CloudFront host; |
| 634 | `mirror.gcr.io` serves its own. |
| 635 | |
| 636 | **What was built** (`crates/runner/src/docker`, `actions/containers.rs`): |
| 637 | |
| 638 | - **One Engine per job, started lazily.** The runner listens on |
| 639 | `/var/run/docker.sock` itself and starts `dockerd` (root, the flags |
| 640 | above, containerd image store, `mirror.gcr.io` first for Docker Hub) on |
| 641 | the first connection, or when the job has `services:` or `container:`. |
| 642 | A log line says it started and how long it took. |
| 643 | - **Containers on the job's network.** The socket is an API proxy: a |
| 644 | container that asks for a bridge or user network gets `host`; its names |
| 645 | (container name, aliases, Compose service, links) resolve to 127.0.0.1 |
| 646 | in later containers (`ExtraHosts`) and in the job's steps |
| 647 | (`/etc/hosts`); `-p 8080:80` is forwarded; `docker inspect` reports the |
| 648 | ports as published; `network connect` adds aliases. Sharing the job's |
| 649 | network is also what keeps the guardrails on every container: the |
| 650 | egress Worker sees their traffic as the job's. |
| 651 | - **A `runc` shim.** The runner binary, as `runc`: BuildKit steps bound for |
| 652 | a bridge lose the network namespace and the libnetwork hook (so they use |
| 653 | the job's network); in a guarded job every container (run, exec, build |
| 654 | step) gets the egress certificate at `/dev/g1t-egress` and the |
| 655 | variables that point tools at it. `/dev` is the container's own tmpfs, |
| 656 | so none of it lands in a layer; checked by saving a built image. |
| 657 | - **Job features:** `services:` (pull, credentials, health waits, logs at |
| 658 | the end, `job.services.*`), `container:` (steps and JavaScript actions |
| 659 | through `docker exec`, Node mounted from the runner, Alpine falls back to |
| 660 | running actions beside it), `docker://` steps and Dockerfile actions in |
| 661 | GitHub's `/github/*` layout, `docker/setup-buildx-action` answered |
| 662 | natively (the job's Engine is the builder), sign-in to g1t's registry |
| 663 | with the run's token. |
| 664 | - **Kill switch:** the runner Worker's `DOCKER` var (`off`). |
| 665 | |
| 666 | **Rejected:** rootless Docker or BuildKit (does not start in Containers); |
| 667 | Podman or buildah with `vfs` (no better networking, less compatible, slow); |
| 668 | a standalone `buildkitd --oci-worker-net=host` as the default builder |
| 669 | (images not in the Engine's store, so `FROM` a just-built image and |
| 670 | `docker run` of a build fail without `--load` round trips); a `docker` CLI |
| 671 | wrapper adding `--network=host` (misses Compose, SDKs and testcontainers, |
| 672 | which speak the API). |
| 673 | |
| 674 | **Not yet:** |
| 675 | |
| 676 | - Seen on Cloudflare itself: whether a sandbox's disk takes overlays, |
| 677 | `--privileged`, and the first deploy's pull of the base from |
| 678 | `registry.cloudflare.com` (its layer host may need a workflow-only line). |
| 679 | - `type=gha` build caches backed by g1t's Actions cache. |
| 680 | - Multi-platform builds (QEMU's `binfmt_misc` in a sandbox). |
| 681 | - Docker for agents and checks, not just workflow jobs. |
| 682 | - `runner-base.yml` on g1t's machines: the base's apt step needs |
| 683 | `Acquire::https::CAInfo` pointed at the egress certificate first. |
| 684 | - A deploy that appends the runner binary as a layer through the registry |
| 685 | API, with no Docker and no 3 GB pull. |
| 686 | |
| 687 | Agents can also reach integrations directly: an agent definition lists MCP |
| 688 | servers (Sentry, Linear and so on) it may use while working. |
| 689 | |
| 690 | ### Workflows: the toolkit, OIDC and artifacts |
| 691 | |
| 692 | > **2026-10-08:** built so that workflows that deploy, cache and pass files |
| 693 | > run unmodified. |
| 694 | |
| 695 | - **The toolkit's services.** Every job gets `ACTIONS_RUNTIME_TOKEN` (a |
| 696 | JWT whose `scp` names its run and job, signed with a key derived from |
| 697 | the job's own token, so nothing new is kept), `ACTIONS_RESULTS_URL`, |
| 698 | `ACTIONS_CACHE_URL` and `ACTIONS_CACHE_SERVICE_V2`. The API answers the |
| 699 | cache's Twirp service (v2) and its older REST protocol, the artifact |
| 700 | Twirp service, and the signed blob links they hand out (a subset of |
| 701 | Azure Blob's protocol mapped onto R2 multipart uploads), from the same |
| 702 | cache and artifact rows g1t's own runner uses. As the clients' source |
| 703 | reads, `@actions/cache` and `@actions/artifact` treat any server |
| 704 | but github.com as GitHub Enterprise Server, so the cache client speaks |
| 705 | the older protocol and the artifact client refuses to run. g1t's runner |
| 706 | therefore keeps handling `actions/upload-artifact`, `download-artifact` |
| 707 | and `upload-artifact/merge` itself; the Twirp artifact service is there |
| 708 | for clients that do not check. |
| 709 | - **OIDC.** The issuer is `{API}/actions/oidc`, the API's own host, with |
| 710 | discovery, JWKS (RFC 7638 `kid`s, a previous key published while |
| 711 | rotating) and a token endpoint for `core.getIDToken`. Claims follow |
| 712 | GitHub's. A job gets one only when its permissions (or its workflow's) |
| 713 | give `id-token: write`, and never for an untrusted run. The permission |
| 714 | check reads only `id-token` (`services/actions/src/runtime.rs`, |
| 715 | `id_token_permitted`), the seam for the full `permissions:` model. |
| 716 | - **Artifacts** moved from KV to R2 (`a/` in the cache bucket), with rows |
| 717 | in the actions service: numeric ids, 5 GiB each and 10 GiB a run, |
| 718 | zipped by the runner, `retention-days` up to the repository's setting |
| 719 | (1 to 90, 14 by default), `overwrite`, `compression-level`, patterns, |
| 720 | merging and other runs of the same repository. The REST artifacts API and |
| 721 | the `workflow` tool's artifact actions follow GitHub's shapes; the run's |
| 722 | page lists them with size and expiry, with download and delete. Their |
| 723 | storage is charged with the cache's. |
| 724 | - **Later:** the toolkit's older artifact protocol (`upload-artifact@v3` |
| 725 | inside other actions), downloads from other repositories, and npm |
| 726 | trusted publishing, which depends on npm accepting g1t's issuer. |
| 727 | |
| 728 | ## A repository that maintains itself |
| 729 | |
| 730 | > **2026-10-04:** the user asked for Dependabot, GitHub Advanced Security and |
| 731 | > Vercel-style deployments, "so you're not having to maintain shit and you're |
| 732 | > just pushing up agents that are delivering work consistently". |
| 733 | |
| 734 | GitHub reports problems and leaves the fix to you. In g1t, an agent opens an |
| 735 | issue for each problem, writes the fix, runs its checks, links a preview and |
| 736 | lands it through the queue. People only decide. |
| 737 | |
| 738 | ### Upkeep agents |
| 739 | |
| 740 | - **Dependency updates.** The file is `dependabot.yml` version 2, read from |
| 741 | the default branch at `.g1t/dependabot.yml` (or `.yaml`), then |
| 742 | `.github/dependabot.yml` (or `.yaml`); `.g1t/` wins when both exist, and |
| 743 | an imported repository's file works unchanged. Every option is read and |
| 744 | checked, each problem reported with its line and key on the Security page |
| 745 | and as the `g1t / dependabot.yml` status on pull requests that change the |
| 746 | file; a file with problems is not acted on. |
| 747 | - **Built (2026-10-07):** version updates for npm, cargo, gomod and pip: |
| 748 | schedules (all intervals, cron and natural phrases, time zones, a |
| 749 | picked time per repository), allow, ignore, cooldown (3 days by |
| 750 | default), groups (including across directories and `group-by`), |
| 751 | versioning strategies, open-pull-requests-limit, commit-message, |
| 752 | branch names, rebase-strategy, assignees, reviewers, private |
| 753 | registries filled from workflow secrets (npm, cargo, Go proxy, Python |
| 754 | index), and the `@g1t` comment commands. Pull requests come from g1t |
| 755 | with an `updated-dependencies` commit record and land through the |
| 756 | required checks; one that fails them is closed and becomes a |
| 757 | "needs code changes" issue assigned to g1t. |
| 758 | - **Security updates follow the same file:** ignore (and comment |
| 759 | ignores), allow names, `applies-to: security-updates` groups, |
| 760 | commit-message, assignees, reviewers, labels and milestone. Cooldown |
| 761 | and the open pull request limit do not apply. The Security updates |
| 762 | switch still turns them on and off. |
| 763 | - **Labels, milestone and target-branch** are applied to version |
| 764 | updates: `dependencies` and the ecosystem's label by default, missing |
| 765 | labels created; `target-branch` updates are made from that branch and |
| 766 | merge into it. |
| 767 | - **Not done yet:** one pull request for a multi-ecosystem group |
| 768 | (it opens one per ecosystem); registries that sign in with OIDC; |
| 769 | updating vendored copies; and version updates for the other |
| 770 | ecosystems (bundler, composer, docker, github-actions, gradle, maven, |
| 771 | nuget, terraform, uv and the rest are read and checked only). |
| 772 | - **Secret scanning.** Pushes are scanned for known token formats. A push |
| 773 | that adds a secret is refused with the file and line; one already in |
| 774 | history opens an issue to rotate it and remove it. |
| 775 | - **Vulnerability alerts.** Dependencies are matched against the OSV |
| 776 | database. Every alert links to the issue and pull request fixing it. |
| 777 | - **Code scanning.** A reviewer agent reads each pull request's diff for |
| 778 | security problems and leaves findings as review comments with a |
| 779 | suggested fix. Findings on `main` open issues. |
| 780 | - **A security page per repository** lists alerts, secrets and findings, |
| 781 | with the agent work on each, like GitHub's Security tab. |
| 782 | |
| 783 | All of these are event sources for the existing issue → agent → checks → |
| 784 | queue pipeline; they need no new kind of work. |
| 785 | |
| 786 | ### The security suite (built 2026-10-07) |
| 787 | |
| 788 | GitHub Advanced Security's depth, in g1t's shape (services/security, |
| 789 | `g1t_contracts::security_suite`, docs `guides/security/*`): |
| 790 | |
| 791 | - **Secret protection.** Custom patterns (repository and workspace; Rust |
| 792 | `regex`, linear time, size-limited; test strings; dry run over the |
| 793 | default branch) used by push protection, `commit_file` and history |
| 794 | scans. Bypass with a reason (false positive, used in tests, will fix |
| 795 | later), recorded on the alert and in the audit log; delegated bypass |
| 796 | (requests reviewed by owners and repository admins, through the inbox). |
| 797 | Validity checks for GitHub, GitLab, Stripe, Slack, npm, OpenAI, |
| 798 | Anthropic and SendGrid tokens, made by the repos service, which reads the |
| 799 | landed secret again: the value never leaves it except to the issuer. AWS |
| 800 | keys (need their secret key to sign) and webhook addresses (would post) |
| 801 | are the extension points left (`g1t_scan::validity::check_for`). |
| 802 | - **Code scanning.** SARIF 2.1.0 uploads → alerts with fingerprints (tool |
| 803 | partial fingerprints first), fixed when no longer reported; pull request |
| 804 | uploads → line comments and the `Code scanning` commit status, gated by a |
| 805 | per-repository threshold and required like any check. Starter workflow: |
| 806 | a scanner per language present, each uploading its own category: Bandit |
| 807 | (Python), gosec (Go), ESLint + eslint-plugin-security with the SARIF |
| 808 | formatter (JS/TS), Clippy + clippy-sarif (Rust); all install from the |
| 809 | registries the runner's egress already allows. Semgrep's registry rules |
| 810 | and the Opengrep rules fork are not usable in a paid feature, so neither |
| 811 | is used. "Fix with g1t" opens an issue and runs the agent. |
| 812 | - **Supply chain.** Dependency graph (direct/transitive where the lockfile |
| 813 | says, npm licenses), SPDX 2.3 SBOM, `Dependency review` status on every |
| 814 | pull request (OSV severity threshold, license deny list, summary comment). |
| 815 | - **Overview.** Workspace totals, opened/closed, a daily snapshot trend, |
| 816 | coverage, repositories most in need first. |
| 817 | - **Paid.** The Security and quality activation on private repositories; |
| 818 | free on public ones; the free core (secret scanning, push protection, |
| 819 | vulnerability alerts, security updates, dependency graph) free everywhere. |
| 820 | |
| 821 | Not built yet: |
| 822 | |
| 823 | - **The reviewer agent as an analysis source.** g1t's reviewer reads each |
| 824 | pull request's diff (`agent_review`), but its findings are review |
| 825 | comments, not SARIF. Next: have it emit SARIF for the security issues it |
| 826 | finds and upload them as the tool `g1t review`, so they become alerts and |
| 827 | count toward the Code scanning check. |
| 828 | - **Repository security advisories.** Private advisories, draft → |
| 829 | published, with affected versions (ranges per ecosystem), severity and a |
| 830 | CVSS vector, credits, and a private fork (a `g1t/advisory/GHSA-…` working |
| 831 | copy only the advisory's collaborators can see) for the fix, merged into |
| 832 | the default branch when the advisory publishes. Published advisories |
| 833 | should feed the OSV-shaped data other g1t repositories' vulnerability |
| 834 | alerts read. CVE requests are out of scope. Needs: an `advisories` table |
| 835 | per repository, a collaborator list per advisory, the private-fork |
| 836 | visibility rule in repos, and an Advisories page on the Security tab. |
| 837 | - **SARIF upload as a background job.** Uploads are read in the request |
| 838 | (10 MB encoded, 40 MB unzipped, 5,000 results); larger ones need a queue. |
| 839 | |
| 840 | ### Deployments |
| 841 | |
| 842 | - **A preview for every pull request**, at |
| 843 | `<pr>--<repo>--<owner>.g1t.page`, linked on the pull request and updated |
| 844 | on each push. `main` deploys to `<repo>--<owner>.g1t.page`, and a |
| 845 | repository can add its own domain. |
| 846 | - **On g1t.page, not g1t.sh,** so customer code never shares cookies or an |
| 847 | origin with the site people sign in to. |
| 848 | - **Built on Workers for Platforms.** Each deployment is a user Worker in a |
| 849 | dispatch namespace; one dispatch Worker on `*.g1t.page` routes to it. The |
| 850 | build runs in the same runners as Actions. Static sites and Workers apps |
| 851 | first; container apps and databases later. |
| 852 | - **Agents use the preview.** The reviewer agent opens the preview in a |
| 853 | browser, takes screenshots of what changed and attaches them to its |
| 854 | review, so an approver sees the result without reading the diff. |
| 855 | - **Environments.** Preview, production and their secrets; deploy history |
| 856 | and one-click rollback. |
| 857 | - **Scale to zero.** An idle branch costs neither g1t nor the customer |
| 858 | anything: a Worker runs, and is billed, only while it answers a request. |
| 859 | A preview is deleted when its pull request closes or merges, and after |
| 860 | a set number of idle days. Container apps, later, sleep when idle. |
| 861 | - **Billed to the customer, never free.** The user (2026-10-04): "we |
| 862 | should not be giving any of this available for free". Every deployment |
| 863 | is metered per workspace (requests, CPU time, deployed apps, stored |
| 864 | data), priced at Cloudflare's cost + 20% like agent usage, and drawn |
| 865 | from prepaid credit. `FREE_WHILE_BUILDING` and the free model allowance |
| 866 | do not cover deployments: a workspace without credit cannot deploy, and |
| 867 | turning deployments on says so first. |
| 868 | - **Turning them on is a paid plan, the way Cloudflare's is.** "Including |
| 869 | things like them even enabling the feature should have that pay like |
| 870 | Cloudflare does." Enabling deployments for a workspace starts a monthly |
| 871 | fee that includes an allowance of requests, CPU time and deployed apps; |
| 872 | usage past it is billed per unit, as Workers for Platforms bills g1t. |
| 873 | The fee and allowance are the user's to set. |
| 874 | - **Recommended, off in one click.** Because enabling costs money, it is |
| 875 | never switched on without the workspace agreeing: new repositories |
| 876 | recommend it prominently. A repository can turn it off, keep only production, or |
| 877 | deploy somewhere else from its own workflows. Apps built for Cloudflare |
| 878 | (Workers, static assets, D1, KV, R2) deploy without configuration. |
| 879 | |
| 880 | Later, toward GitLab's DevOps breadth: package and container registries, |
| 881 | releases, container hosting. (Environments' protection rules for g1t |
| 882 | Actions were built on 2026-10-08; see above.) |
| 883 | |
| 884 | ## Projects |
| 885 | |
| 886 | > **2026-10-04:** the user: "an extra dimension of Projects so it's not |
| 887 | > just repositories … where a lot of things can live", "very Vercel |
| 888 | > like", with dependencies across projects "the Platform Engineering / |
| 889 | > Port route", and "the repository is *part* of a project: you could be |
| 890 | > mirroring it from GitHub/GitLab/Bitbucket, or you could let us host it |
| 891 | > for you", with room for Mercurial or anything else later. |
| 892 | |
| 893 | **A project is the thing you are building and running; a repository is |
| 894 | where some of its code lives.** Everything that is about running software |
| 895 | (deployments, environments, domains, secrets, dependencies, owners, |
| 896 | health, upkeep) belongs to the project. What is about the code itself |
| 897 | (branches, pull requests, review, merge rules) stays with the repository. |
| 898 | That split is what lets the code live anywhere. |
| 899 | |
| 900 | ### The model |
| 901 | |
| 902 | | | What it is | Like | |
| 903 | | --- | --- | --- | |
| 904 | | **Workspace** | The company or team. Members, billing, plans, shared secrets. | Vercel team, GitLab group, GitHub org | |
| 905 | | **Group** | An optional named set of projects, one level: "Payments", "Mobile". For browsing, ownership and shared settings. | GitLab subgroup, Backstage system, Port domain | |
| 906 | | **Project** | One deployable thing: a site, an API, a worker, a library. Has exactly one **source**. | Vercel project, Port service, Backstage component | |
| 907 | | **Source** | Where its code is: a repository and a **root directory** in it. | Vercel's connected repo + root directory | |
| 908 | | **Dependency** | Project A uses project B: calls its API, consumes its package, reads its queue. | Port relations, Backstage `dependsOn` | |
| 909 | |
| 910 | - **One project, one source; one repository, any number of projects.** A |
| 911 | project builds from exactly one place, which keeps it as simple as |
| 912 | Vercel's. A monorepo is several projects on one repository, each with |
| 913 | its own root directory (`apps/web`, `services/api`), and a push builds |
| 914 | only the projects whose root it touched. The common case stays 1:1, and |
| 915 | every existing repository gets a project of its own name when this |
| 916 | ships, so nobody has to set anything up. |
| 917 | - **Groups are for people; dependencies are for software.** Groups decide |
| 918 | where a project shows up and who owns it. Dependencies decide what |
| 919 | happens when one changes. Neither replaces the other, and a dependency |
| 920 | can cross groups. |
| 921 | |
| 922 | ### Sources: where the code lives |
| 923 | |
| 924 | A source is an adapter behind one interface (`SourcePort`: clone URL, |
| 925 | branches, commits, pushes as events, pull requests if it has them): |
| 926 | |
| 927 | | Source | Code lives | g1t gets pushes by | Pull requests | |
| 928 | | --- | --- | --- | --- | |
| 929 | | **Hosted on g1t** (today) | Artifacts | its own events | g1t's, with agents, the queue, review | |
| 930 | | **Mirrored** from GitHub, GitLab or Bitbucket | Both; g1t keeps a copy | the provider's webhook, then fetch | The provider's, read into g1t; agents open theirs there | |
| 931 | | **Connected, not copied** | The provider only | webhook | The provider's | |
| 932 | | **Later:** Mercurial, Perforce, a tarball upload | Behind the same port | per adapter | per adapter | |
| 933 | |
| 934 | A mirrored or connected project still gets everything that is the |
| 935 | project's: previews on its pull requests (a status and a comment on |
| 936 | GitHub's), production on its default branch, secrets, dependencies, |
| 937 | upkeep agents. That is the on-ramp: a team keeps GitHub and gets g1t's |
| 938 | deployments and agents first, and moves the code later or never. |
| 939 | Bring-your-own-git is also why the project, not the repository, holds the |
| 940 | URL `g1t.sh/<workspace>/<project>`. |
| 941 | |
| 942 | ### What lives on a project |
| 943 | |
| 944 | | | Today it is on | Moves to the project | |
| 945 | | --- | --- | --- | |
| 946 | | Deployments: production, previews, build settings, root directory, framework | The repository | Yes | |
| 947 | | Environments: production, preview, and custom ones (`staging`) with protection rules (required approvers, branch limits) | Nowhere yet | New, on the project | |
| 948 | | Domains: `<project>--<workspace>.g1t.page`, and custom domains | The repository's name | Yes | |
| 949 | | Secrets and variables | The repository | Yes. Workspace rows link to projects instead of repositories. A repository's workflows read the rows of its project (with several projects on one repository, the one marked as the repository's default). | |
| 950 | | Dependencies | Nowhere | New | |
| 951 | | Owners, on-call, links (docs, dashboards, runbooks) | Nowhere | New: the catalog's metadata | |
| 952 | | Health: scorecards (has an owner, CI passes, dependencies current, no open security alerts, deploys within N days) | Nowhere | New | |
| 953 | | Upkeep agents: dependency updates, security alerts | The plan | Scoped per project | |
| 954 | | Logs and analytics of the running app | Nowhere | New: requests, errors and CPU per environment, from Workers analytics | |
| 955 | | Branches, pull requests, review, merge rules, the queue, webhooks | The repository | Stay | |
| 956 | |
| 957 | ### Dependencies: why this gets powerful |
| 958 | |
| 959 | Declared in the UI, or in the source as `.g1t/project.yml` (which wins |
| 960 | when present, as `catalog-info.yaml` does in Backstage): |
| 961 | |
| 962 | ```yaml |
| 963 | name: web |
| 964 | root: apps/web |
| 965 | dependsOn: |
| 966 | - project: api # calls its HTTP API |
| 967 | as: API_URL # its URL, per environment, as a variable |
| 968 | - project: ui-kit # consumes its package |
| 969 | ``` |
| 970 | |
| 971 | What g1t does with them: |
| 972 | |
| 973 | 1. **Reference variables.** `API_URL` above resolves to `api`'s production |
| 974 | URL in production and to the matching preview in a preview, the way |
| 975 | Railway's `${{ api.URL }}` references work. No hard-coded URLs. |
| 976 | 2. **Preview stacks.** A pull request on `api` gets its own preview, and |
| 977 | **Preview with dependents** builds `web`'s preview pointed at it, so a |
| 978 | reviewer clicks through the whole change across projects. A change that |
| 979 | spans repositories (one issue, one fork per repository) gets one stack. |
| 980 | 3. **Release order.** Production deploys go out in dependency order; a |
| 981 | change set across projects lands through the queue together or not at |
| 982 | all. |
| 983 | 4. **Impact on every pull request.** "Changes `api`; `web` and `mobile` |
| 984 | depend on it." Agents get the graph in their context: an agent |
| 985 | changing an API opens follow-up issues on the projects that call it, |
| 986 | and reviewers see what else could break. |
| 987 | 5. **Upkeep across the graph.** A vulnerable package in `ui-kit` opens |
| 988 | issues, assigned to agents, on every project that consumes it. |
| 989 | 6. **Scorecards turn into work.** A project failing a scorecard check |
| 990 | ("no owner", "dependencies 90 days old") gets an issue an agent can fix. |
| 991 | That is the Port idea with the work done for you. |
| 992 | 7. **The map.** A workspace's projects as a graph, coloured by health and |
| 993 | by what is deploying now. |
| 994 | |
| 995 | ### Pages |
| 996 | |
| 997 | - `g1t.sh/<workspace>`: projects first (grouped, with health and |
| 998 | production status), then repositories. |
| 999 | - `g1t.sh/<workspace>/<project>`: overview (production, latest previews, |
| 1000 | health, owners, dependencies both ways), **Deployments**, |
| 1001 | **Environments**, **Secrets and variables**, **Logs**, **Settings** |
| 1002 | (source, root directory, build, domains, groups, owners). |
| 1003 | - A hosted repository keeps its code pages; from a project they are its |
| 1004 | **Code** tab. A repository page lists the projects built from it. |
| 1005 | |
| 1006 | ### Services |
| 1007 | |
| 1008 | - `services/projects` (new): projects, groups, sources, dependencies, |
| 1009 | owners, scorecards. Events `project.created`, `project.updated`, |
| 1010 | `dependency.changed`. |
| 1011 | - `services/deployments`: keyed by project instead of repository. |
| 1012 | - Secrets and variables: the scope becomes workspace → project. |
| 1013 | - Sources: the hosted adapter wraps `services/repos`; a mirror adapter |
| 1014 | per provider in `services/integrations`, which already holds those |
| 1015 | connections. |
| 1016 | |
| 1017 | ### Build order |
| 1018 | |
| 1019 | 1. **Projects as the home of deployments and secrets**, 1:1 with every |
| 1020 | existing repository: the service, the pages, deployments and secrets |
| 1021 | moved to the project, `<project>--<workspace>.g1t.page`. |
| 1022 | 2. **Dependencies:** declared in the UI and `.g1t/project.yml`, reference |
| 1023 | variables, impact on pull requests and in agents' context, the map. |
| 1024 | 3. **Preview stacks** and cross-project change sets. |
| 1025 | 4. **Monorepos:** several projects on one repository, each with a root |
| 1026 | directory, building only what a push touched. |
| 1027 | 5. **Mirrored sources:** GitHub first, then GitLab and Bitbucket. |
| 1028 | 6. **Groups, owners, scorecards** feeding the upkeep agents. |
| 1029 | 7. **Environments** with protection rules; custom domains; logs. |
| 1030 | |
| 1031 | **Step 1 shipped 2026-10-04:** `services/projects`; every repository a |
| 1032 | project of its own name; the site projects-first (workspace page of |
| 1033 | project cards, the project overview at `g1t.sh/<workspace>/<project>`, code |
| 1034 | under `/code`, the sidebar and the New project flow); deployments keyed by |
| 1035 | project and branch at `<project>-<workspace>.g1t.page` and |
| 1036 | `<project>-git-<branch>-<workspace>.g1t.page`; secrets and variables owned |
| 1037 | by the project. |
| 1038 | |
| 1039 | **Step 5, GitHub, built 2026-10-05:** one GitHub App (`g1t-sh`) for both |
| 1040 | sign-in and repository access. Sign-in is its user authorization with PKCE |
| 1041 | (identity, `src/github.rs`): accounts known by GitHub's numeric id, a |
| 1042 | matching verified email never linked without signing in to the account, |
| 1043 | new accounts behind the invite check. Repositories come through its |
| 1044 | installations (integrations, `src/github.rs`), copied with every branch and |
| 1045 | tag by the repos service (`src/mirror.rs`) as **import**, **mirror** (g1t |
| 1046 | follows GitHub on its push webhook) or **move to g1t** (GitHub follows g1t |
| 1047 | on `git.push`). A mirror is a hosted repository that keeps a full copy, so |
| 1048 | its project stays `hosted` and deploys like any other; the tie lives in |
| 1049 | integrations' `github_repos`. Not yet: previews and statuses on GitHub's own |
| 1050 | pull requests, comments and pull requests copied, GitLab and Bitbucket. |
| 1051 | |
| 1052 | ### People and search |
| 1053 | |
| 1054 | > **2026-10-04:** "pull up user profiles, using a /u/username prefix kinda |
| 1055 | > like DockerHub … search for users if you search that explicitly, how |
| 1056 | > GitHub has the aside for searching against filters … a significantly |
| 1057 | > stronger implementation." |
| 1058 | |
| 1059 | - **Profiles at `g1t.sh/u/<username>`**, apart from workspaces at |
| 1060 | `g1t.sh/<workspace>`: who they are, their workspaces, recent work, |
| 1061 | agents' sessions they steered. |
| 1062 | - **Search with a filter sidebar:** Projects, Code, Issues, Pull requests, |
| 1063 | Users, Workspaces, each with its count; filters by workspace, language, |
| 1064 | state, author, agent, label, date; qualifiers in the query |
| 1065 | (`user:`, `is:open`, `agent:g1t`) as on GitHub. Typing `u/name` |
| 1066 | searches people directly, as Docker Hub does. |
| 1067 | |
| 1068 | 1 and 2 serve the competition directly (multi-agent coordination across |
| 1069 | projects is 25% of the score); 3 is the demo's best moment if time allows. |
| 1070 | |
| 1071 | ## Billing model |
| 1072 | |
| 1073 | > **2026-10-04:** "Some things just require you to have a card on file … |
| 1074 | > some things will be something you give us an initial amount of money |
| 1075 | > per month just to activate, tons of things additionally will be usage |
| 1076 | > based, some things will just be usage based only … at minimum a |
| 1077 | > breakeven with Cloudflare costs, or in some cases a value add." Stripe |
| 1078 | > moves to Flagon, Inc. (g1t.sh is its product). Proposed below; the |
| 1079 | > prices are the user's to confirm. |
| 1080 | |
| 1081 | ### Four kinds of charge |
| 1082 | |
| 1083 | Every feature is exactly one of these, and the Billing page says which: |
| 1084 | |
| 1085 | | Kind | What the workspace does | Example | |
| 1086 | | --- | --- | --- | |
| 1087 | | **Free** | Nothing | Hosting code, issues, pull requests, review, the merge queue, bringing your own agent over MCP | |
| 1088 | | **Card on file** | Adds a card; pays only for what it uses | Previews, g1t's agents, workflow minutes | |
| 1089 | | **Activation** | Turns a feature on for a monthly fee that includes an allowance; usage past it is metered | Production deployments, Security and quality | |
| 1090 | | **Usage only** | Nothing up front; every unit is metered | Model tokens, build minutes, storage past the free amount | |
| 1091 | |
| 1092 | A card is needed before anything that can cost money starts. Nothing is |
| 1093 | ever switched on without the workspace choosing it. |
| 1094 | |
| 1095 | ### Postpaid, with spend limits |
| 1096 | |
| 1097 | - **One Stripe customer and one subscription per workspace**, on Flagon, |
| 1098 | Inc.'s account. Activations are licensed line items; every usage |
| 1099 | dimension is a metered price backed by a Stripe Meter. Stripe invoices |
| 1100 | monthly in arrears and charges the card on file; failed payments go |
| 1101 | through Stripe's retries and emails, and g1t hears of them by webhook. |
| 1102 | - **Spend limits instead of prepaid credit.** A workspace sets a monthly |
| 1103 | limit overall and per feature (Vercel's spend management). g1t counts |
| 1104 | usage as it happens and stops starting new paid work at the limit, |
| 1105 | with a warning at 50%, 80% and 100%. Prepaid top-ups go away; promotions |
| 1106 | (the free model allowance) become Stripe credit on the customer. |
| 1107 | - **Usage reaches Stripe from billing alone.** Every service reports |
| 1108 | usage to the billing service as it happens (it already records agent |
| 1109 | runs and builds); billing batches them into Stripe meter events every |
| 1110 | few minutes, idempotently by g1t's own ids, and keeps the ledger g1t's |
| 1111 | pages show. Nothing else talks to Stripe. |
| 1112 | |
| 1113 | ### Scope: workspace, then projects |
| 1114 | |
| 1115 | - A feature is turned on for the **workspace** (by an owner, with the |
| 1116 | activation if it has one), then allowed for **all projects** or |
| 1117 | **selected projects**. |
| 1118 | - Every **project** can opt out on its own page. A project with nothing |
| 1119 | to deploy (no Workers config, no build script, no `index.html`) is |
| 1120 | detected, says so on its Deployments page, and never builds or costs |
| 1121 | anything. |
| 1122 | - Agents and workflows are allowed per project the same way, so a |
| 1123 | workspace can keep spend to the projects that matter. |
| 1124 | |
| 1125 | ### Prices: what it costs us, passed through |
| 1126 | |
| 1127 | > **2026-10-04, decided:** postpaid with spend limits, as Vercel and |
| 1128 | > Cloudflare do; no per-seat price, ever ("fuck per-seat pricing"). |
| 1129 | > "If they're barely using them great, but if they're using the shit out |
| 1130 | > of them that will cost me a ton, so that cost needs to move onto them." |
| 1131 | |
| 1132 | **Every Cloudflare cost a workspace causes is metered to it.** Light use |
| 1133 | fits in a small free allowance; past it, each unit is charged at |
| 1134 | Cloudflare's price times a margin of at least 1.5, which pays for Stripe |
| 1135 | (about 3%), shared overhead (the site, the API, D1) and g1t itself. |
| 1136 | |
| 1137 | Cloudflare's prices (October 2026), and the cost per unit g1t meters: |
| 1138 | |
| 1139 | | What g1t meters | Cloudflare's price | Cost to g1t per unit | |
| 1140 | | --- | --- | --- | |
| 1141 | | **Sandbox minute** (agents, checks, merge queue, workflow jobs, deploy builds), standard-1: ½ vCPU, 4 GiB, 8 GB | CPU $0.00002 / vCPU-s while busy; memory $0.0000025 / GiB-s and disk $0.00000007 / GB-s while running | ≤ $0.0012 / minute (CPU counted as busy throughout, since g1t cannot see it per sandbox) | |
| 1142 | | **App request** (deployments) | Workers for Platforms: $0.30 / million past 20M | $0.30 / million | |
| 1143 | | **App CPU** | $0.02 / million CPU-ms past 60M | $0.02 / million ms | |
| 1144 | | **App** (a deployed script) | $0.02 / script-month past 1,000 | $0.02 / app-month | |
| 1145 | | **Storage** (repositories, artifacts, caches) | Artifacts $0.50 / GB-month (billing starts 2026-10-14); KV $0.50 / GB-month | $0.50 / GB-month | |
| 1146 | | **Git operation** (clone, fetch, push) | Artifacts $0.15 / 1,000 past 10,000 | $0.15 / 1,000 | |
| 1147 | | **Model tokens** | The provider's price | As charged | |
| 1148 | | Container egress, emails, the site's own requests | Small and shared | In the margin | |
| 1149 | |
| 1150 | > **2026-10-06, decided:** no per-feature quotas on the plan. "A paying |
| 1151 | > user should be able to push past the Git operations number, they're |
| 1152 | > just paying usage on it." One plan, $20 a month per workspace with $10 |
| 1153 | > of usage included; every meter is charged from the first unit at cost + |
| 1154 | > 20% (builds, app requests and CPU, custom domains), drawn from the $10 |
| 1155 | > first, then up to the spend limit, which is the only thing that stops a |
| 1156 | > paying workspace (with abuse protection). Projects, previews and apps |
| 1157 | > are not metered (Workers for Platforms' script pool makes them ~free). |
| 1158 | > The forge's free amounts are the same for everyone: 1 GB private storage |
| 1159 | > and 50,000 git operations a month; past them the plan pays and a free |
| 1160 | > workspace is held (pushes stop, git slowed). The table below is the |
| 1161 | > earlier proposal; billing's price book and g1t.sh/pricing are current. |
| 1162 | |
| 1163 | What a workspace pays: |
| 1164 | |
| 1165 | | Meter | Free each month | Then | Margin | For comparison | |
| 1166 | | --- | --- | --- | --- | --- | |
| 1167 | | Sandbox minutes | None (2026-10-05: charged from the first second) | Cost + 20%, by the second | 1.2× | GitHub Actions $0.008 / minute (Linux 2-core); Vercel builds $0.0035 / CPU-minute | |
| 1168 | | App requests | 1 million with Deployments | $0.50 / million | 1.7× | Vercel $0.60 / million invocations | |
| 1169 | | App CPU | 3 million ms with Deployments | $0.04 / million ms | 2× | Vercel active CPU about $0.036 / million ms | |
| 1170 | | Apps | 10 with Deployments | $0.05 / app-month | 2.5× | | |
| 1171 | | Storage | 1 GB | $1.00 / GB-month | 2× | GitHub LFS $0.07 / GB, but repositories are free there | |
| 1172 | | Git operations | 10,000 | $0.30 / 1,000 | 2× | | |
| 1173 | | g1t's models | | Cost + 20% | 1.2× | The provider's own price | |
| 1174 | | Your own model provider | | Only its sandbox minutes (the $0.10 run fee was dropped 2026-10-05) | | | |
| 1175 | | **Deployments** activation | | $5 / month, with the allowances above | covers Workers for Platforms' $25 / month across workspaces | Vercel Pro $20 per seat | |
| 1176 | | **Security and quality** activation (built 2026-10-07: price book meter `security_activation`) | | $10 / month; fixes as agent usage | | GitHub Advanced Security $49 per committer | |
| 1177 | |
| 1178 | A workspace that uses g1t lightly (a few agent runs, a small site) |
| 1179 | pays nothing or its activation; a workspace running agents all day pays |
| 1180 | for the sandboxes and models those agents use, with g1t's margin on |
| 1181 | each. Nothing in a workspace's bill is subsidised by another's. |
| 1182 | |
| 1183 | ### Build order |
| 1184 | |
| 1185 | 1. Stripe customer per workspace and card on file (Checkout in setup |
| 1186 | mode), webhooks (invoice paid and failed, subscription changes, |
| 1187 | payment method changes), the Billing page rebuilt around the four |
| 1188 | kinds. |
| 1189 | 2. One subscription per workspace with activations as items; Deployments |
| 1190 | moves onto it. |
| 1191 | 3. Meters for each usage dimension above, fed from billing's ledger: |
| 1192 | every sandbox reports how long it ran when it stops (agents, checks, |
| 1193 | the queue, workflow jobs and deploy builds alike); deployments report |
| 1194 | requests, CPU and apps; repos report storage and git operations. Spend |
| 1195 | limits and their warnings; prepaid credit retired. |
| 1196 | 4. Per-workspace allow-lists of projects for each feature, and per-project |
| 1197 | opt-out; "nothing to deploy" detection. |
| 1198 | 5. Turn off FREE_WHILE_BUILDING when the user says so. **Done 2026-10-05.** |
| 1199 | |
| 1200 | Shipped by 2026-10-05: sandbox seconds for every sandbox; the price book |
| 1201 | and its keeper (runs settled to AI Gateway's price every 15 minutes; |
| 1202 | Container and Workers costs checked against Cloudflare's billable usage |
| 1203 | and container analytics daily, with a public change log on |
| 1204 | g1t.sh/pricing); usage limits by trust with automatic payment near the |
| 1205 | limit; app traffic counted toward limits as it happens; billing accounts, |
| 1206 | terms and enterprises; free mode off, syntaqx comped. |
| 1207 | |
| 1208 | Still to build, in order: Stripe card-on-file without a payment (setup |
| 1209 | mode) and webhooks; month-end invoices for postpaid usage (and one |
| 1210 | invoice per enterprise); the subscription with activations as items; |
| 1211 | storage and git-operation meters; limit warnings by email at 50/80/100%; |
| 1212 | self-serve enterprise management for enterprise owners. |
| 1213 | |
| 1214 | ### Accounts, terms and enterprises |
| 1215 | |
| 1216 | Every workspace is paid for by a billing account: its own (`ws_<slug>`) |
| 1217 | or an enterprise's (`ent_…`), which pays for several workspaces with one |
| 1218 | limit, one set of terms and, once invoices exist, one bill, as GitHub |
| 1219 | Enterprise does. Terms are standard, comped (nothing charged, usage still |
| 1220 | recorded at cost, paid features on) or custom (a discount, its own |
| 1221 | ceiling, an end date). g1t staff manage them in **sudo.g1t.sh**, a |
| 1222 | separate Worker behind Cloudflare Access that also verifies the Access |
| 1223 | token itself and allows only listed staff emails; every change is kept |
| 1224 | with who made it and why. |
| 1225 | |
| 1226 | ### Limits: stop non-payers, never payers |
| 1227 | |
| 1228 | The limit is on usage not yet paid for, counted at cost to g1t or charge, |
| 1229 | whichever is more: $3 before any live payment, then twice what has been |
| 1230 | paid ($25 to $1,000), or what staff set. A workspace with a card on file |
| 1231 | is charged automatically near its limit, which both pays what it owes and |
| 1232 | raises the limit, so paying users are never stopped. A declined card |
| 1233 | stops work until paid. The owner's own spend limit always means stop. |
| 1234 | Test-mode payments never lower exposure or raise trust. |
| 1235 | |
| 1236 | ### Tax, card fees and free workspaces (built 2026-10-08) |
| 1237 | |
| 1238 | > **2026-10-08, decided:** Stripe Tax everywhere ("so I don't fuck up on |
| 1239 | > taxes"); Stripe's card fee passed to the customer with the 20% markup |
| 1240 | > kept; one free workspace per person; no invites on free workspaces. |
| 1241 | |
| 1242 | - **Stripe Tax on every payment.** `automatic_tax` on every Checkout page |
| 1243 | (plan, Security and quality, prepaying, AI credit), every subscription |
| 1244 | and every invoice g1t makes (month close, threshold, enterprise), and a |
| 1245 | tax calculation and transaction for auto-reload's off-session charge. |
| 1246 | Tax code `txcd_10103001` (SaaS, business use), every price |
| 1247 | `tax_behavior=exclusive`. Checkout always collects the billing address |
| 1248 | and tax ID and saves them on the customer. Prices on g1t are shown |
| 1249 | excluding tax. Tax is never revenue: balances and plan payments are |
| 1250 | credited without it, it is kept in `tax_and_fees`, shown as its own |
| 1251 | statement line, and as **Tax collected** on sudo's Costs. Without an |
| 1252 | address g1t does not charge: the owners are asked for one. |
| 1253 | - **The card fee** (2.9% + $0.30, grossed up) is its own line on every |
| 1254 | card payment, the plan's and Security's as a monthly item; never on a |
| 1255 | bank transfer or an enterprise's invoice. On by default |
| 1256 | (`cost_settings.card_fee`). Not revenue either. Meters stay at cost + |
| 1257 | 20%; models at the provider's price plus the agent rate. |
| 1258 | - **One free workspace per person.** Identity asks billing |
| 1259 | (`free_workspaces`) before creating one; a second is refused with the |
| 1260 | way forward. Those who own several from before keep them. |
| 1261 | - **A free workspace adds no one**: no members, invites or outside |
| 1262 | collaborators until it starts the plan; its members stay; @g1t never |
| 1263 | counts. Enforced in identity for every path (site, API, MCP). |
| 1264 | - Details: docs/BILLING_OPERATIONS.md, *Tax and the card fee*. |
| 1265 | |
| 1266 | ### Promo codes (planned) |
| 1267 | |
| 1268 | Staff credits (promotional, goodwill, refund; `services/billing/src/grants.rs`, |
| 1269 | docs/BILLING_OPERATIONS.md) are given one workspace at a time. Promo codes |
| 1270 | give promotional credit in bulk, on redemption, through the same grants: |
| 1271 | |
| 1272 | - **Codes.** sudo → Credits & refunds → **New code**: the code (or one |
| 1273 | made up), the credit ($ amount), max redemptions, when the code stops |
| 1274 | working, how long each redeemed credit lasts (an expiry, as any grant), |
| 1275 | and a note. Table `promo_codes` (code, amount, max, redeemed, ends_at, |
| 1276 | credit_days, note, created_by, disabled_at) and `promo_redemptions` |
| 1277 | (code, workspace, grant id, by, at), unique on (code, workspace). |
| 1278 | - **Redeeming.** An owner types it on the workspace's Billing page |
| 1279 | (`redeem_code`, owners only). One D1 batch checks the code is open, under |
| 1280 | its max and not redeemed by the workspace, counts the redemption and |
| 1281 | makes the grant (`grant_credit`, kind promotional, the code as its note), |
| 1282 | so two redemptions at once never pass the max. Wrong or used-up codes say |
| 1283 | so without telling which codes exist; redemptions are rate-limited per |
| 1284 | owner. |
| 1285 | - **Seeing them.** Each code's redemptions, credit given and spent come |
| 1286 | from the grants it made, so margin needs nothing new: spent promo credit |
| 1287 | is already given away, by kind. |
| 1288 | - **Not yet built** because it adds an owner-facing form, abuse limits and |
| 1289 | a second sudo form; giving credit by workspace covers launch. |
| 1290 | |
| 1291 | ## Agents and models |
| 1292 | |
| 1293 | ### Defining an agent |
| 1294 | |
| 1295 | An agent is a file (`.g1t/agents/<name>.md`, or in the workspace library): |
| 1296 | instructions, the harness and model to run, the tools and MCP servers it may |
| 1297 | use, its sandbox image, permissions and budget. Agents take roles: planner, |
| 1298 | implementer, reviewer, conflict resolver, documenter, memory consolidator. |
| 1299 | Each role has a default that a repo can replace. |
| 1300 | |
| 1301 | ### Where it runs, and on whose model |
| 1302 | |
| 1303 | | Option | How it works | Fits | |
| 1304 | | --- | --- | --- | |
| 1305 | | Hosted, g1t's model | g1t runs the sandbox and bills usage | Getting started; no keys to manage | |
| 1306 | | Hosted, your API key | Same sandbox, your Anthropic, OpenAI or Google key | Teams with existing contracts | |
| 1307 | | Hosted, your endpoint | Any OpenAI-compatible URL: Bedrock, Vertex, Azure, a self-hosted model | Private or fine-tuned models | |
| 1308 | | Your runner | A g1t runner daemon on your own machines picks up pull requests | Code or models that may not leave your network | |
| 1309 | | Your own session | Local Claude Code, Cursor or any MCP client joins through `mcp.g1t.sh` | Individuals; subscription plans | |
| 1310 | |
| 1311 | Decisions behind this: |
| 1312 | |
| 1313 | - **g1t does not build its own agent loop.** It runs existing harnesses |
| 1314 | (Claude Code first, through its headless mode) behind a small runner |
| 1315 | contract: a container image, an entry command, and session events reported |
| 1316 | through the CLI. Other harnesses plug in by meeting the contract. |
| 1317 | - **All hosted model traffic goes through Cloudflare AI Gateway.** That gives |
| 1318 | one place for spend tracking, budgets, rate limits, fallback and logs, |
| 1319 | whichever provider or endpoint is behind it. |
| 1320 | - **Nobody has to pick a model.** A person assigns work to `g1t`, as |
| 1321 | they would assign an issue to a colleague, and **Auto** routes each job |
| 1322 | to the cheapest model that can do it (see |
| 1323 | [Routing for cost](#routing-for-cost) below). A workspace can pin a tier |
| 1324 | per kind of work instead. Each request is tagged at the gateway with the |
| 1325 | kind of work, the tier, the repository and the pull request, and each |
| 1326 | run says which model ran and why. The gateway's own dynamic routes |
| 1327 | cannot make the choice yet: they work only on its OpenAI-compatible |
| 1328 | endpoint, and the harness speaks Anthropic's. |
| 1329 | - **Subscriptions stay local.** A Claude subscription cannot be used by a |
| 1330 | hosted sandbox; it needs an API key. People on subscriptions use their own |
| 1331 | Claude Code session, which is a full participant. |
| 1332 | - **The workspace pays.** A workspace buys AI credit by card and each |
| 1333 | agent run deducts the model at the provider's price plus the agent rate |
| 1334 | per million (weighted) tokens; on its own model key, only the agent rate, |
| 1335 | counted from the model proxy and the sandbox's own report. The billing service asks |
| 1336 | nothing of the others: the runner asks it before starting a sandbox and |
| 1337 | is refused when there is no credit, and the sandbox reports what its run |
| 1338 | cost with a token only it holds. Where no card processor is configured |
| 1339 | nothing is charged and agents stay limited to listed accounts. |
| 1340 | - **Keys are secrets.** Stored in Cloudflare Secrets Store, injected into the |
| 1341 | sandbox for one pull request, never shown again. |
| 1342 | |
| 1343 | ### Seeing a pull request through |
| 1344 | |
| 1345 | Assigning an issue is the only thing a person does until there is something |
| 1346 | to merge. A pull request made by g1t goes through checks, a review |
| 1347 | by another agent, revision when either finds something, and catching up |
| 1348 | when `main` moves, without anyone pressing a button. It ends as ready to |
| 1349 | merge, or as "needs you" with the reason: the checks still fail after two |
| 1350 | revisions, a review could not be written, or a conflict could not be |
| 1351 | resolved. |
| 1352 | |
| 1353 | The work service decides the next step from the pull request's state and |
| 1354 | claims it in one statement, so a step is taken once. The runner asks on |
| 1355 | every event that could change the answer (ready, pushed, checks finished, |
| 1356 | review finished, `main` moved), and on a five-minute sweep for anything |
| 1357 | missed, and carries the step out in a sandbox. |
| 1358 | |
| 1359 | A pull request does not have to be up to date with `main` to merge, |
| 1360 | unless the repository's settings require it, as on GitHub. Merging one that |
| 1361 | is behind brings it up to date first (a clean merge needs no model; an |
| 1362 | agent resolves a conflict) and lands it when that push arrives. With the |
| 1363 | requirement on, catching up is a step of its own and the checks run again |
| 1364 | on the result. |
| 1365 | |
| 1366 | Each repository sets its own rules, on one settings page: whether its |
| 1367 | default branch takes pushes at all, how many approvals a merge needs and |
| 1368 | whether an agent's counts, whether failed checks can be overridden, whether |
| 1369 | a second agent reviews, and how often an agent is sent back before a person |
| 1370 | is asked. A pull request g1t opens follows the same rules as anyone's. |
| 1371 | Pushes to a protected branch are refused in the git front end, with the |
| 1372 | reason shown by git beside the branch. |
| 1373 | |
| 1374 | Merging is a person's decision unless the repository says otherwise. With |
| 1375 | "merge automatically when ready" turned on in its settings, a ready pull |
| 1376 | request lands by itself, attributed to `g1t`. That is the whole path from |
| 1377 | an assigned issue to a commit on `main` with nobody in between. Required |
| 1378 | human approval per path, and risk tiers, are still to come. |
| 1379 | |
| 1380 | ### Routing for cost |
| 1381 | |
| 1382 | *Built (runner `route` in `services/runner/src/model-env.ts`).* The goal |
| 1383 | is cost per merged change, not cost per request: a cheap attempt that |
| 1384 | fails and is retried on the same model costs more than one that finishes. |
| 1385 | |
| 1386 | - **Tiers and catalogue.** `small` (Claude Haiku 5.5 since 2026-10-08, |
| 1387 | $0.10/$0.50 per million input/output up to 100k-token prompts, five |
| 1388 | times that above; it was Haiku 4.5 at $1/$5), `large` (Claude Sonnet 5.5, $2/$10) and `frontier` |
| 1389 | (Claude Opus 5.5, $4/$20). Models, names and list prices are data, |
| 1390 | never code: since 2026-10-08 billing's model catalogue |
| 1391 | (`gateway_models`, one row per model g1t can use) and staff's defaults |
| 1392 | in sudo, **Agents & models** (`model_defaults`: each tier's model, the |
| 1393 | harness's background model, the AI Gateway's first Claude, each job's |
| 1394 | starting tier and effort), read by the runner once a minute over |
| 1395 | `AGENT_ROUTING`, which is only the fallback when billing cannot be read. |
| 1396 | Catalogue prices are for estimates only; runs are charged what AI |
| 1397 | Gateway priced them at. |
| 1398 | - **Keeping up with new models (built 2026-10-08).** The models service |
| 1399 | lists Anthropic's models (through the AI Gateway) and Workers AI's daily |
| 1400 | and on demand; a new id lands in the catalogue as `new`, priced from a |
| 1401 | maintained table of Anthropic's list prices or Workers AI's listing, or |
| 1402 | unpriced, and staff are emailed. Nothing routes to it, offers it or |
| 1403 | charges for it until staff approve it with its prices. A model a provider |
| 1404 | stops listing is `deprecated`; routing never sends work to a deprecated |
| 1405 | or retired model, falling back to the next model of the tier and saying |
| 1406 | so on the run. Customers keep Auto: the catalogue is staff's. See |
| 1407 | [BILLING_OPERATIONS.md](BILLING_OPERATIONS.md#the-model-catalogue). |
| 1408 | - **Starting tier by job.** Catch-up, answering a question, and reviews of |
| 1409 | at most 10 files and 200 lines touching no sensitive path: small. |
| 1410 | Plans: small at high effort (Haiku 5.5 takes an effort level). |
| 1411 | Changes, revisions and other reviews: large. Reviews over 60 files |
| 1412 | or 3,000 lines: frontier. Labels: `architecture` frontier, `security` off |
| 1413 | small, `docs`/`documentation`/`typo` let changes and answers start small. |
| 1414 | - **Escalation.** A failed (or guardrail-stopped) attempt at the same work |
| 1415 | goes one tier up; two in a row, frontier; a revision counts its rounds; |
| 1416 | a change left at low confidence sends the next attempt up. |
| 1417 | - **Learning, per repository.** From the last 20 runs of the same kind: |
| 1418 | one tier down when the cheaper tier finished at least 90% of at least 5 |
| 1419 | (never for sensitive or labelled work, never on a retry); one tier up |
| 1420 | when this tier failed at least half of at least 5. No new tables: it |
| 1421 | reads work's `agent_runs` (model, status, confidence). |
| 1422 | - **Explained.** Every run's first step and session note is one line: |
| 1423 | *Used a fast model (Claude Haiku 5.5): small change, 3 files and 80 |
| 1424 | lines.* Effort per kind of job (`effort` in `AGENT_ROUTING`: plan high, |
| 1425 | answer medium, update low) is sent as `CLAUDE_CODE_EFFORT_LEVEL` on |
| 1426 | g1t's tiers (never on a model the catalogue says takes none) and named |
| 1427 | in that line, with the catalogue's name for the model. |
| 1428 | - **Chosen instead.** `model_routes` rows to g1t's models name `small`, |
| 1429 | `large` or `frontier`, or nothing for Auto (Integrations → Models). |
| 1430 | A workspace's own Anthropic key with no model named is routed by Auto |
| 1431 | too. |
| 1432 | - **Measured.** `scripts/ops/routing-savings.mjs` replays tasks through |
| 1433 | the router offline, priced from the catalogue, against routing before |
| 1434 | Auto and against the frontier model for everything, net of failed |
| 1435 | attempts, with cost per merged change; `--live` reads billing's runs and |
| 1436 | counted tokens. On the bundled sample (13 tasks, assumed failures): Auto |
| 1437 | costs 7% less than the frontier model for everything and about 7% more |
| 1438 | per run than routing before it, but half as much per merged change, |
| 1439 | because it finishes the hard tasks the old routing gave up on. At |
| 1440 | current prices Opus 5.5 and Sonnet 5.5 cost the same per cache read, and |
| 1441 | cache reads are most of an agent run's tokens, so moving off the |
| 1442 | frontier model saves less than its list price suggests; the fast tier |
| 1443 | and fewer failed attempts are where the money is. Run `--live` monthly |
| 1444 | and after any routing change. |
| 1445 | - **A cheaper route for the simplest jobs (designed, off).** A fourth tier |
| 1446 | on Workers AI through AI Gateway (an open model, billed on Cloudflare's |
| 1447 | invoice) for classification-sized jobs: commit messages, triage, |
| 1448 | summaries. Behind the same router as a tier with its own catalogue entry |
| 1449 | and `tasks` rules, off by default. It needs the proxy to translate the |
| 1450 | harness's Anthropic requests to the gateway's OpenAI-compatible |
| 1451 | endpoint (it already does for workspaces' own OpenAI-shaped providers) |
| 1452 | and a quality bar from the savings harness before any job moves to it. |
| 1453 | |
| 1454 | ### Choosing the right agent automatically |
| 1455 | |
| 1456 | Because several agents can work on the same issue, every issue with more |
| 1457 | than one pull request is an evaluation on real work. g1t records, per repo and per kind of issue, each |
| 1458 | agent's win rate, cost and time. That produces a leaderboard, and a routing |
| 1459 | policy: send each new issue to the agent that wins that kind most often, |
| 1460 | start with the cheapest that is good enough, and escalate to a stronger one |
| 1461 | when checks fail. |
| 1462 | |
| 1463 | ## Talking: the inbox and channels |
| 1464 | |
| 1465 | Not a discussions forum. People and agents need one place to talk in real |
| 1466 | time, and an app that feels like one on desktop and phone. |
| 1467 | |
| 1468 | **The inbox comes first.** Everything that needs a person or that they |
| 1469 | follow, from people and agents: review requests, agent questions and |
| 1470 | handoffs, failures, mentions, deploys. Read and unread, saved, done, |
| 1471 | snoozed; ranked so what an agent is blocked on comes first; email digests |
| 1472 | and push. It is the delivery layer chat needs too (who is told what, read |
| 1473 | state, push), so building it first makes channels cheap. |
| 1474 | |
| 1475 | *Built:* the events service keeps it (`services/events/src/inbox.rs` and |
| 1476 | `subscriptions.rs`, migrations `0005_inbox` and `0006_inbox_threads` on the |
| 1477 | `g1t-events` database), writing items as events arrive from the bus; work's |
| 1478 | `inbox_subject` says what each event names. Each person has one **thread** |
| 1479 | per issue, pull request, workflow on a branch or deployment: new activity |
| 1480 | brings it back unread with a count and its last 10 activities, and while it |
| 1481 | is unread its most urgent severity is kept. Each item has a **reason** |
| 1482 | (`agent`, `review_requested`, `assign`, `mention`, `ci_activity`, |
| 1483 | `security_alert`, `state_change`, `author`, `comment`, `manual`, |
| 1484 | `subscribed`). Who is told: `agent.asked` and `pull.stalled` (needs you, |
| 1485 | closed again by `pull.resumed` and the like), `pull.review_requested` |
| 1486 | (needs you, closed by `pull.review_request_removed`), |
| 1487 | `issue.assigned`/`pull.assigned`, failed checks and workflows, |
| 1488 | `deployment.failed` and a recovering `deployment.succeeded`, g1t's reviews |
| 1489 | and finished changes, closes, reopens and merges to everyone subscribed, |
| 1490 | and comments to the people mentioned and everyone subscribed. Never the |
| 1491 | actor, never g1t. **Subscriptions**: authors, assignees and reviewers are |
| 1492 | subscribed without a row; commenting or being mentioned subscribes; anyone |
| 1493 | can subscribe, unsubscribe (still told of what is asked of them) or ignore. |
| 1494 | **Watching** a repository: participating (the default), all, ignore, or |
| 1495 | custom (issues, pulls, deployments, security); whoever creates a repository |
| 1496 | watches it at their default, all activity unless they change it. |
| 1497 | **Settings**: which reasons are also emailed (agent, review_requested and |
| 1498 | mention by default) and the default watch for new repositories; email goes |
| 1499 | through identity's `notify_by_email`, to a confirmed address only while the |
| 1500 | person can still read the repository. **REST and MCP**: 14 operations under |
| 1501 | `/notifications`, `/repos/:owner/:name/subscription` and |
| 1502 | `/user/subscriptions` (scopes `notifications:read` and |
| 1503 | `notifications:write`, in the Agent preset), and the `notifications` MCP |
| 1504 | tool; never usable by g1t's own tokens. On the site: a bell in the top bar |
| 1505 | opening a sheet with tabs (All, Needs you, Errors, Success, Info), Done, |
| 1506 | Save, Snooze and Mark all read; `/inbox` with Saved, Done and a reason |
| 1507 | filter; reasons and update counts on each card; a Notifications box on |
| 1508 | issue and pull request pages; a Watch menu in the repository header; |
| 1509 | Settings → Notifications; a Needs you card on mission control. Agent sits |
| 1510 | beside the bell, disabled. Still to come: security alerts (the security |
| 1511 | service publishes no event yet), email digests and push, Agent, and |
| 1512 | channels. |
| 1513 | |
| 1514 | **Channels** (working name): workspace channels, direct messages and |
| 1515 | threads, live. |
| 1516 | |
| 1517 | - Each channel is a Durable Object holding its WebSocket connections with |
| 1518 | hibernation, so idle channels cost nothing; history in D1, files in R2. |
| 1519 | - Agents are members. `@g1t` in a channel starts work, answers, or |
| 1520 | posts a summary; agents post their questions and handoffs where people |
| 1521 | already are. A thread becomes an issue or an outcome in one action, and |
| 1522 | the agent's progress streams into that thread. |
| 1523 | - Tied to the work: issues, pull requests, runs and deploys each have a |
| 1524 | thread; links unfurl into live cards (checks, agent step, preview). |
| 1525 | What a channel settles can become workspace memory, with its source. |
| 1526 | - Apps: an installable PWA first (desktop and mobile, offline shell, Web |
| 1527 | Push), then native shells on the same API: Tauri for desktop (tray, |
| 1528 | deep links), React Native for iOS and Android (background |
| 1529 | notifications). |
| 1530 | |
| 1531 | GitHub-style Discussions are not planned: channels and threads on the |
| 1532 | work replace them. |
| 1533 | |
| 1534 | ## What GitHub ships today, and where g1t differs |
| 1535 | |
| 1536 | GitHub's Agent HQ and Copilot app give each agent session its own git |
| 1537 | worktree and branch, list sessions in a mission-control view grouped by |
| 1538 | project, and let a task be assigned to several agents so their output can be |
| 1539 | compared. Underneath, the unit of work is still a branch and a pull request. |
| 1540 | |
| 1541 | | | GitHub | g1t | |
| 1542 | | --- | --- | --- | |
| 1543 | | Where a session works | A worktree on one developer's machine, or a cloud sandbox | A server-side fork that any agent on any machine can join and anyone can open | |
| 1544 | | Agent context | Lives in the app's session view | Stored with the repository and linked from each commit (why-blame) | |
| 1545 | | Several agents on one task | Separate pull requests to compare by hand | One issue holding every pull request made for it, compared side by side, with the merged one recorded on the issue | |
| 1546 | | Collisions between agents | Found as merge conflicts at the end | Flagged during the work (overlap radar) | |
| 1547 | | Landing changes | One pull request at a time | A merge queue that lands the chosen one and closes the rest as superseded | |
| 1548 | | Which agents | Those offered through a Copilot subscription | Any MCP client, plus hosted agents | |
| 1549 | |
| 1550 | ## How agents connect |
| 1551 | |
| 1552 | 1. **Bring your own agent.** A remote MCP server at `mcp.g1t.sh` lets Claude |
| 1553 | Code (or any MCP client) list issues, claim one, get a clone URL and |
| 1554 | token, report progress and submit. Adding it is one command; sign-in is a |
| 1555 | browser OAuth flow with no token to paste. The `g1t` CLI installs Claude |
| 1556 | Code hooks that upload the session transcript as the agent works. |
| 1557 | 2. **g1t's agent.** Assign an issue to g1t, or many issues at |
| 1558 | once, each to an agent of its own. g1t starts a sandbox for each |
| 1559 | (Cloudflare Containers), running a coding agent headless against its |
| 1560 | own pull request and fork. |
| 1561 | 3. **API and CLI.** Everything above is available at `api.g1t.sh` and |
| 1562 | through `g1t`. |
| 1563 | |
| 1564 | ## Public surfaces |
| 1565 | |
| 1566 | | Host | What it serves | |
| 1567 | | --- | --- | |
| 1568 | | `g1t.sh` | The site, git over HTTPS, git over SSH | |
| 1569 | | `api.g1t.sh` | REST API, with no version in its paths, with a published OpenAPI document, cursor pagination, rate-limit headers, idempotency keys on writes, server-sent events for live pull request state, and signed webhooks | |
| 1570 | | `mcp.g1t.sh` | Remote MCP server over streamable HTTP | |
| 1571 | |
| 1572 | g1t is its own OAuth 2.1 authorization server: authorization code with PKCE, |
| 1573 | dynamic client registration that stores nothing (a client id encodes its |
| 1574 | own registration, so the open endpoint cannot be used to fill a database), |
| 1575 | discovery metadata and rotating refresh tokens. Still to come: scopes |
| 1576 | per resource (`repo:read`, `repo:write`, `issue:write`, `pull:write`). |
| 1577 | MCP clients, the CLI (device flow) and third-party apps all use it. Access |
| 1578 | tokens and SSH keys remain for git itself. |
| 1579 | |
| 1580 | ### Workspace aliases (internal, built 2026-10-07) |
| 1581 | |
| 1582 | `g1t` is the product; `flagon-io` is Flagon, Inc., the organization that |
| 1583 | builds it. So nobody mistakes one for the other, `g1t.sh/g1t` leads to |
| 1584 | `g1t.sh/flagon-io`. That is a workspace alias: a name g1t's staff point at |
| 1585 | a workspace, kept in identity's `workspace_aliases` (migration 0029, which |
| 1586 | seeds `g1t`) by the workspace's id, so it follows renames. It is not a |
| 1587 | customer feature and is not documented for users; staff add and remove |
| 1588 | aliases on sudo's Aliases page, with a reason, in sudo's audit log. We may |
| 1589 | give other companies one for a trading name the same way. |
| 1590 | |
| 1591 | An alias is resolved wherever an old slug is (identity's `resolve_slug`), |
| 1592 | so it costs only the not-found path: site pages 301 to the same page under |
| 1593 | the workspace, the API and MCP run the call again under its slug, package |
| 1594 | registries 301, and git over HTTPS is answered in place |
| 1595 | (`resolve_alias`), because pushes do not follow redirects. An alias is |
| 1596 | never a route, a username or a workspace's slug, and nobody can register |
| 1597 | it while it exists. `@g1t` stays g1t's agent: mentions link to how the |
| 1598 | agent works, never to `/g1t`. |
| 1599 | |
| 1600 | ## Architecture |
| 1601 | |
| 1602 | | Component | Language | Runs on | Responsibility | |
| 1603 | | --- | --- | --- | --- | |
| 1604 | | `crates/contracts`, `packages/contracts` | Rust, TypeScript | — | The interface of every service, the event catalogue, shared types. Services and clients depend on this, never on each other's code. | |
| 1605 | | `services/identity` | Rust | Worker + D1 | Accounts, workspaces and memberships, sessions, SSH keys, access tokens, device sign-in, OAuth codes and grants | |
| 1606 | | `services/repos` | Rust | Worker + D1 + Artifacts | Repository registry, contents, forks, diffs, landing, git over HTTPS. Storage sits behind a `GitStore` port with an Artifacts adapter. | |
| 1607 | | `services/work` | Rust | Worker + D1 | Issues, pull requests, comments, sessions; later a Durable Object per repo for the landing queue and live state | |
| 1608 | | `services/billing` | Rust | Worker + D1 + Stripe | Each workspace's agent credit: payments, the ledger of every run, and the gate on starting one | |
| 1609 | | `services/events` | Rust | Worker + Queues + D1 | The event bus: durable log, and one queue per subscribing service | |
| 1610 | | `services/runner`, `crates/runner` | TypeScript, Rust | Worker + Containers | Starts a sandbox per g1t run; the program inside runs the agent harness and reports through the public API | |
| 1611 | | `services/og` | TypeScript | Worker + Cache API | Social cards at `og.g1t.sh`: one PNG per page of the site and the docs (satori and resvg), looked up as an anonymous visitor, so nothing private appears on one | |
| 1612 | | `apps/web` | TypeScript | Worker | Server-rendered site. Holds no data; calls services over RPC. | |
| 1613 | | `apps/docs` | TypeScript | Worker (static) | Documentation and the API explorer | |
| 1614 | | `apps/api` | Rust | Worker | REST API (`api.g1t.sh`), MCP server (`mcp.g1t.sh`) and OpenAPI document, all generated from one list of operations; the OAuth endpoints | |
| 1615 | | `crates/sshd` | Rust | Container | Git over SSH, bridged to Artifacts | |
| 1616 | | `crates/merged` | Rust | Container | Trial merges, conflict matrix, landing merges (needs real git; the Artifacts binding is read-only) | |
| 1617 | | `crates/core` | Rust | native and WASM | pkt-line, packfile and diff code shared by the above and by the Worker | |
| 1618 | | `crates/g1t` | Rust | user's machine | CLI: auth, SSH proxy, Claude Code hooks, issues and pull requests | |
| 1619 | |
| 1620 | Storage: Artifacts for repositories (one fork per pull request), D1 for accounts |
| 1621 | and metadata, R2 for session transcripts and logs, Durable Object SQLite for |
| 1622 | per-repo coordination state. |
| 1623 | |
| 1624 | How the services fit together: |
| 1625 | |
| 1626 | - **Each service is its own Worker with its own database.** It deploys, |
| 1627 | scales and fails on its own. Callers reach it through a typed RPC binding |
| 1628 | to the interface in `packages/contracts`. |
| 1629 | - **Expected failures are values.** Every call returns a `Result`, so "not |
| 1630 | found" or "forbidden" crosses a service boundary as data. |
| 1631 | - **Side effects travel as events.** A service publishes what happened |
| 1632 | (`git.push`, `issue.opened`, `pull.merged`, …) to the bus and does not |
| 1633 | call other services to react. Each subscriber consumes from its own queue. |
| 1634 | Timelines, webhooks and automations read the same stream, which is what |
| 1635 | lets something like GitHub Actions be built on top. |
| 1636 | - **Every read takes the viewer.** Authorization is decided inside the |
| 1637 | service that owns the data, not by its callers. |
| 1638 | |
| 1639 | The Workers runtime scales request handling on its own, so the edge layer |
| 1640 | stays in TypeScript. Rust is used where there is real computation or a real |
| 1641 | protocol to implement. |
| 1642 | |
| 1643 | ## Languages |
| 1644 | |
| 1645 | The site is TypeScript. Everything behind it is Rust, compiled to |
| 1646 | WebAssembly for Workers and natively for containers and the CLI. Identity, repos, work, events and the API are all Rust. The one exception |
| 1647 | is the Worker that starts sandboxes, because Cloudflare's Containers |
| 1648 | library is TypeScript. Rust services speak a |
| 1649 | small JSON protocol over service bindings (`POST /rpc/<method>`), with the |
| 1650 | types in `crates/contracts`. |
| 1651 | |
| 1652 | ## Identifiers |
| 1653 | |
| 1654 | Every id is a [TypeID](https://github.com/jetify-com/typeid): a prefix naming |
| 1655 | the kind of thing, then a UUIDv7 in lowercase base32, such as |
| 1656 | `pr_01jb2k7x9hfq0b3zj0f5s2m8ra`. |
| 1657 | |
| 1658 | - The prefix makes an id self-describing and stops ids of different kinds |
| 1659 | being mixed up. |
| 1660 | - Ids sort by creation time as plain strings. In SQLite (D1 and Durable |
| 1661 | Objects) that keeps inserts at the end of the primary-key index instead of |
| 1662 | scattering them, and gives time-ordered paging for free. |
| 1663 | - The suffix decodes to a standard UUIDv7 for any system that wants one. |
| 1664 | - Ids are made by the service that creates the record, not by the database, |
| 1665 | so they work across services and can be assigned before a write. |
| 1666 | |
| 1667 | ## Events at scale, and audit |
| 1668 | |
| 1669 | The current event log is a single D1 database. That is fine for a |
| 1670 | prototype and wrong for the target: D1 is one writer and 10 GB. The design |
| 1671 | for volume splits storage by how the data is read. |
| 1672 | |
| 1673 | | Tier | Store | Holds | Read by | |
| 1674 | | --- | --- | --- | --- | |
| 1675 | | Hot | A Durable Object per repository, with SQLite | Recent events for that repo | Timelines, live pages over WebSocket | |
| 1676 | | Complete | Cloudflare Pipelines into R2 as Apache Iceberg | Every event, forever, partitioned by day and workspace | Analytics, standups, "ask", export | |
| 1677 | | Audit | The same R2 store, under object lock | Who did what, from where, with which credential | Compliance, investigation | |
| 1678 | |
| 1679 | - **No single hot database.** Each repository's recent events live with that |
| 1680 | repository, so load spreads across as many objects as there are repos. |
| 1681 | - **The complete record is files, not rows.** Iceberg on R2 has no practical |
| 1682 | size limit and is queried with SQL. |
| 1683 | - **Audit is a property of every event.** The envelope carries the actor |
| 1684 | (person, agent, token or system), the credential used, the request id and |
| 1685 | the source address. Audit entries for a workspace are hash-chained, so a |
| 1686 | removed or altered entry is detectable, and are written under a retention |
| 1687 | lock. |
| 1688 | - **Delivery is at least once.** Consumers are idempotent on the event id. |
| 1689 | |
| 1690 | ## Accounts and forge basics |
| 1691 | |
| 1692 | - Registration with email verification, sign-in, forgot password (Cloudflare |
| 1693 | Email Sending), Turnstile on public forms. |
| 1694 | - GitHub sign-in, SSH keys, access tokens, active sessions. |
| 1695 | - Profiles, public and private repositories, repository search (D1 full-text). |
| 1696 | - Rendered README, syntax highlighting, commit history, diffs. |
| 1697 | - Transferring a repository between workspaces (by id: its git store key |
| 1698 | never moves; every service follows `repo.transferred`; old paths redirect |
| 1699 | until reused) and deleting an empty, settled workspace (its slug is |
| 1700 | tombstoned, never reissued except to the person whose username it is). |
| 1701 | - Access: five repository roles, a workspace base permission, outside |
| 1702 | collaborators and invitations. Teams are built on it (2026-10-07): visible |
| 1703 | or secret, nested up to 8 levels (child teams inherit their parents' |
| 1704 | roles), run by maintainers and owners. A team's role on a repository is a |
| 1705 | `repo_grants` row whose principal is the team, which identity resolves |
| 1706 | into the same `RepoGrant`s on each person, so `access::can` needs nothing |
| 1707 | new: the highest role wins. `@workspace/team` mentions tell the team's |
| 1708 | people; a team asked to review either asks everyone or picks people by |
| 1709 | round robin or load balance. |
| 1710 | - CODEOWNERS, read in both conventions (single-section, and sections with |
| 1711 | approval counts, optional sections and default owners) from the first of |
| 1712 | `.g1t/`, `.github/`, the root, `docs/` and `.gitlab/`. Owners are asked to |
| 1713 | review, the `g1t / codeowners` status lints a changed file, and branch |
| 1714 | protection's "Require review from code owners" holds merges, for people, |
| 1715 | agents and the queue alike, until each owning rule is approved. |
| 1716 | |
| 1717 | ## Built on Cloudflare |
| 1718 | |
| 1719 | | Need | Product | |
| 1720 | | --- | --- | |
| 1721 | | Repositories; a fork per pull request; data residency per workspace | Artifacts (forks, jurisdictions) | |
| 1722 | | Reacting to pushes | Artifacts event subscriptions on Queues | |
| 1723 | | Preview URL per pull request; deploy on merge | Workers for Platforms on `g1t.page` | |
| 1724 | | Site, API, MCP, git front end | Workers | |
| 1725 | | Per-repo coordination, live updates | Durable Objects | |
| 1726 | | Pull request lifecycles, automations | Workflows, Cron Triggers | |
| 1727 | | Agent sandboxes, SSH server, merge engine | Sandbox SDK and Containers | |
| 1728 | | Fast starts on large repos | ArtifactFS | |
| 1729 | | Model traffic, spend, budgets | AI Gateway | |
| 1730 | | Summaries, embeddings | Workers AI | |
| 1731 | | Context hub search | Vectorize | |
| 1732 | | Accounts and metadata | D1 | |
| 1733 | | Transcripts and logs | R2 | |
| 1734 | | Email, bot protection, keys | Email Sending, Turnstile, Secrets Store | |
| 1735 | |
| 1736 | ## Running g1t yourself |
| 1737 | |
| 1738 | g1t.sh runs on Cloudflare, and that does not change. The core is MIT and |
| 1739 | must also run on anyone's own machine with `docker compose up`. A free |
| 1740 | core people can self-host is what makes paid hosting worth trusting. |
| 1741 | Self-hosting never makes hosted worse: hosted code paths keep their |
| 1742 | behaviour, and a self-hosted adapter sits beside the hosted one. The |
| 1743 | inventory of every Cloudflare dependency, the design and the risks are in |
| 1744 | [SELF_HOSTING.md](SELF_HOSTING.md). |
| 1745 | |
| 1746 | The approach: the Workers stay Workers, and self-hosted they run in |
| 1747 | workerd, the open-source Workers runtime. D1, KV and Queues are SQLite on a |
| 1748 | volume, with the same migrations. Cloudflare-only bindings are replaced |
| 1749 | by stand-ins: |
| 1750 | |
| 1751 | - Artifacts becomes bare repositories served by `git http-backend`; |
| 1752 | - Email Sending becomes SMTP, through Mailpit; |
| 1753 | - services that are off answer "off" instead of failing. |
| 1754 | |
| 1755 | | Phase | Scope | Estimate | |
| 1756 | | --- | --- | --- | |
| 1757 | | 1. Core forge | Done: `deploy/self-host/` (compose, git store, binding stand-ins, smoke test) and the "Run g1t yourself" guide. Left: the API on its own port, `PUBLIC_URL` in place of hard-coded hosts, cron, pull requests in the smoke test, CI that runs it. | 1–1.5 weeks left | |
| 1758 | | 2. Agents | Docker sandboxes with the same runner image, an egress allow-list proxy for guardrails, `g1t.toml`, a launcher in place of `wrangler dev` | 2–3 weeks | |
| 1759 | | 3. Search, context, deployments | sqlite-vec plus an OpenAI-compatible embedder; an app host on workerd; Caddy for app and custom domains; SSH | 3–4 weeks | |
| 1760 | | 4. Parity and upgrades | Code-level ports in `g1t_kit` and `@g1t/platform`, sudo without Access, online backups, released images, an upgrade test in CI | 3–4 weeks | |
| 1761 | |
| 1762 | ## The submission |
| 1763 | |
| 1764 | - **g1t is built on g1t.** This repository is hosted on g1t.sh, its features |
| 1765 | are opened as issues and built by racing agents, and it deploys from |
| 1766 | Artifacts through Workers Builds. The history is the proof. |
| 1767 | - **The demo follows one story.** A brief becomes a project; twelve issues |
| 1768 | fan out to dozens of agents; agents notice each other, hand off, and |
| 1769 | resolve a conflict; reviewers triage; the queue lands everything on |
| 1770 | `main`; why-blame explains a line; the portfolio shows where it all |
| 1771 | stands. Then the same thing at a thousand agents. |
| 1772 | - **Judges can try it in a minute.** Open registration on g1t.sh, one-click |
| 1773 | import of a GitHub repo, one command to connect Claude Code, a seeded demo |
| 1774 | workspace, and a single deploy command for running their own copy. |
| 1775 | - **The formats are open.** The commit trailers, session format and runner |
| 1776 | contract are published so other tools can interoperate. |
| 1777 | |
| 1778 | ## Build order |
| 1779 | |
| 1780 | What is left is ordered by how much it shows the point above, not by forge |
| 1781 | parity. Forge basics are done well enough; each item below should make the |
| 1782 | demo's story stronger. |
| 1783 | |
| 1784 | Done from this list: the outcome page (a plan's issues as a live graph with |
| 1785 | cost and a feed of what happened), coordination you can see (agents' issues |
| 1786 | and comments stand out in the feed; agents hold g1t's tools through a token |
| 1787 | scoped to one repository), steering a running agent (messages delivered |
| 1788 | between steps, and at the end), and recording sessions from anyone's own |
| 1789 | Claude Code (`curl -fsSL https://g1t.sh/install/claude.sh | sh`). Integrations are |
| 1790 | in: a workspace's own model provider (Anthropic or any Anthropic-compatible |
| 1791 | endpoint, reached through a model proxy so no sandbox holds a key; its |
| 1792 | runs pay only their sandbox time), alerts from Sentry, Datadog and signed webhooks |
| 1793 | that open one issue per problem and can start an agent, and Jira and Linear |
| 1794 | tickets that agents read, people import, and that hear back. Racing a |
| 1795 | set number of agents on one issue is dropped: choosing how many agents to |
| 1796 | use is not something people should have to do. |
| 1797 | |
| 1798 | 1. ~~**Handoffs and questions between agents** as states on the outcome |
| 1799 | page.~~ Done: questions and handoffs show as waiting, read, answered, |
| 1800 | taken on or declined; since 2026-10-03 an agent asked while it is not at |
| 1801 | work is woken to answer, where before the question waited forever. |
| 1802 | 2. **Upkeep agents** (above): dependency updates, secret scanning, |
| 1803 | vulnerability alerts, code scanning, the security page. No new |
| 1804 | infrastructure. |
| 1805 | 3. **Deployments on `g1t.page`** (above): previews per pull request, |
| 1806 | production on merge, the reviewer agent checking the preview. |
| 1807 | 4. **The large run, building 2 and 3.** About 20–30 issues on g1t itself, |
| 1808 | built by agents and landed through the queue, for the video: g1t built |
| 1809 | on g1t. |
| 1810 | 5. **Polish for judges trying it in a minute:** a seeded demo workspace, the |
| 1811 | empty states, and the first-run path from sign-up to an outcome landing. |
| 1812 | |
| 1813 | Earlier items still open, after those: |
| 1814 | |
| 1815 | 1. Deleting a branch once its pull request merges; risk tiers. (Approval |
| 1816 | rules per path are in, as CODEOWNERS.) |
| 1817 | 2. Scopes on OAuth grants and access tokens. (Done, with fine-grained |
| 1818 | tokens and workspace rules for them, 2026-10-08.) |
| 1819 | 3. Event storage per the design above: per-repo hot log, Iceberg on R2, |
| 1820 | hash-chained audit. |
| 1821 | 4. CLI with Claude Code hooks to record sessions automatically. |
| 1822 | 5. Reviewing and catching up automatically, by policy; required reviews; |
| 1823 | risk tiers. |
| 1824 | 6. Compare view, proof bundles; handoff between agents. |
| 1825 | 7. Projects, mission control, steering; why-blame, digest, timeline. |
| 1826 | 8. Context hub, portfolio; automations and integrations (Sentry first). |
| 1827 | 9. SSH; bot protection; own keys, endpoints and runners. |
| 1828 | 10. Large run (100+ agents across many issues), hardening, demo. |
| 1829 | |
| 1830 | Later: code search, mirroring to GitHub, passkeys, SSH |
| 1831 | on port 22 without the CLI proxy (needs the Workers inbound TCP private |
| 1832 | beta). |